CVE-2026-45135: Caddy Server FastCGI RCE Vulnerability

CVE-2026-45135 Overview

Caddy is an extensible HTTP server platform that uses Transport Layer Security (TLS) by default. CVE-2026-45135 affects Caddy versions 2.7.0 through 2.11.2 in the FastCGI reverse proxy transport. The splitPos() function in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when a request path contains a non-ASCII byte. Two distinct flaws in that fallback path let an attacker mislead Caddy's FastCGI splitting logic into treating a non-.php file as a script. Where attackers can place content into files served via FastCGI, the flaw escalates to remote code execution.

Critical Impact

Attackers who control file uploads or storage served through Caddy's FastCGI transport can achieve remote code execution by crafting URL paths that exploit path-splitting confusion.

Affected Products

• Caddy 2.7.0 through 2.11.2
• Deployments using the FastCGI reverse proxy transport
• Configurations that serve user-controllable content via FastCGI handlers

Discovery Timeline

• 2026-06-23 - CVE-2026-45135 published to the National Vulnerability Database
• 2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-45135

Vulnerability Analysis

The vulnerability resides in Caddy's FastCGI path-splitting logic. The splitPos() function determines where a request URL path ends and the script path information begins, typically by locating the configured split_path extension such as .php. When the request path contains a non-ASCII byte, the code falls back to golang.org/x/text/search configured with search.IgnoreCase. This Unicode-aware search returns match positions that do not align with the byte boundaries the surrounding code assumes. The classification is [CWE-20] Improper Input Validation.

Root Cause

The root cause is the mismatch between Unicode collation semantics and byte-oriented path parsing. The search.IgnoreCase matcher operates on Unicode normalization forms and case folding, so a single input rune may match a sequence of different byte length in the source. Two distinct flaws in this fallback let an attacker manipulate the reported split position so a file without the configured extension is forwarded to the FastCGI handler as if it were a script.

Attack Vector

An attacker first places attacker-controlled content into a file that Caddy serves through FastCGI. Upload endpoints, object storage gateways, and user file shares are the typical paths. The attacker then requests a URL whose path contains a crafted non-ASCII byte that forces splitPos() down the vulnerable Unicode search branch. The FastCGI backend, usually PHP-FPM, receives the attacker file as SCRIPT_FILENAME and executes its contents. No authentication is required when the upload surface itself is unauthenticated. See the GitHub Security Advisory GHSA-m675-2p33-xv9g for the technical writeup.

Detection Methods for CVE-2026-45135

Indicators of Compromise

• Access log entries with non-ASCII bytes in request paths routed to FastCGI handlers.
• FastCGI requests where SCRIPT_FILENAME resolves to a file extension other than the one configured in split_path (for example, .jpg, .txt, or .png).
• PHP-FPM or other FastCGI worker processes spawning shells, network clients, or compilers shortly after serving uploaded files.

Detection Strategies

• Inspect Caddy access logs for requests containing URL-encoded non-ASCII byte sequences targeting paths under upload or storage directories.
• Correlate FastCGI backend execution logs with request URIs to identify scripts run from non-script extensions.
• Alert on outbound network connections initiated by FastCGI worker processes immediately after a request to an upload directory.

Monitoring Recommendations

• Enable verbose Caddy access logging that preserves raw request paths before decoding.
• Forward FastCGI worker process telemetry, including child process creation, to a centralized log platform.
• Track file write events in directories backing the FastCGI handler and correlate with subsequent request activity.

How to Mitigate CVE-2026-45135

Immediate Actions Required

• Upgrade Caddy to version 2.11.3 or later, which removes the vulnerable Unicode fallback in splitPos().
• Audit all FastCGI handler configurations and identify any directories where unauthenticated users can write files.
• Restrict upload directories so files written by users cannot be served through the FastCGI handler.

Patch Information

The vulnerability is fixed in Caddy 2.11.3. Operators should update binaries, container images, and any reverse proxy deployments built on the Caddy module API. Refer to the Caddy GitHub Security Advisory for upstream release notes and patch commits.

Workarounds

• Move uploaded files out of any directory matched by FastCGI route patterns until the patch is applied.
• Configure the FastCGI handler to match only exact .php request paths using a stricter path matcher that rejects non-ASCII bytes.
• Place a web application firewall or reverse proxy in front of Caddy that drops requests containing non-ASCII bytes in paths targeting FastCGI endpoints.

# Example Caddyfile snippet restricting FastCGI to ASCII .php paths
@php {
    path_regexp phpscript ^/[\\x00-\\x7F]*\.php(/|$)
}
reverse_proxy @php unix//run/php/php-fpm.sock {
    transport fastcgi {
        split .php
    }
}