CVE-2026-45135

Name of the Vulnerable Software and Affected Versions Caddy versions 2.7.0 through 2.11.2

Description The FastCGI transport's splitPos() function in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses the search.IgnoreCase feature of the golang.org/x/text/search library when a request path contains non-ASCII bytes. This leads to two flaws: a control-flow issue where a stale match variable allows non-script files to be treated as scripts, and a Unicode equivalence issue where non-ASCII lookalike characters are folded into ASCII characters (e.g., treating .𝗽𝗵𝗽 as .php). In deployments where an attacker can upload or place content into files served via FastCGI, these flaws can be exploited by crafting a specific URL to achieve remote code execution.

Recommendations Update to version 2.11.3.