Nixpkgs security tracker
8.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.
References
-
https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g x_refsource_CONFIRMexploit
Affected products
- ==>= 2.7.0, < 2.11.3
Matching in nixpkgs
pkgs.caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
pkgs.xcaddy
Build Caddy with plugins
pkgs.caddyfile-language-server
Basic language server for caddyfile
pkgs.vimPlugins.nvim-treesitter-parsers.caddy
Tree-sitter grammar for caddy
-
nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
-
nixos-26.05 0.0.0+rev=2686186
- nixos-26.05-small 0.0.0+rev=2686186
- nixpkgs-26.05-darwin 0.0.0+rev=2686186
pkgs.tree-sitter-grammars.tree-sitter-caddyfile
Tree-sitter grammar for caddyfile
-
nixos-unstable 0-unstable-2026-04-06
- nixpkgs-unstable 0-unstable-2026-04-06
- nixos-unstable-small 0-unstable-2026-04-06
-
nixos-26.05 0-unstable-2026-04-06
- nixos-26.05-small 0-unstable-2026-04-06
- nixpkgs-26.05-darwin 0-unstable-2026-04-06
pkgs.vscode-extensions.matthewpi.caddyfile-support
Rich Caddyfile support for Visual Studio Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
Package maintainers
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
-
@matthewpi Matthew Penner <me+nix@matthewp.io>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>