CVE-2026-52846

4.2

MEDIUMCVSS v3

Published

June 23, 2026

Affected

9 projects

Assigned by

GitHub

Severity scale

010

Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely. This vulnerability is fixed in 2.11.4.

caddyserver/caddy

GitHubFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

< 2.11.4NVD

caddy

Docker HubCaddy 2 is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.

< 2.11.4NVD

caddy

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Semester project for OOP course

< 2.11.4NVD

Caddy

ChocolateyCaddy is a powerful, extensible platform to serve your sites, services, and apps, written in Go. ## Features - **Easy configuration** with the [Caddyfile](https://caddyserver.com/docs/caddyfile) - **Powerful configuration** with its [native JSON config](https://caddyserver.com/docs/json/) - **Dynamic configuration** with the [JSON API](https://caddyserver.com/docs/api) - [**Config adapters**](https://caddyserver.com/docs/config-adapters) if you don't like JSON - **Automatic HTTPS** by default - [Let's Encrypt](https://letsencrypt.org) for public sites - Fully-managed local CA for internal names & IPs - Can coordinate with other Caddy instances in a cluster - **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues - **HTTP/1.1, HTTP/2, and experimental HTTP/3** support - **Highly extensible** [modular architecture](https://caddyserver.com/docs/architecture) lets Caddy do anything without bloat - **Runs anywhere** with **no external dependencies** (not even libc) - Written in Go, a language with higher **memory safety guarantees** than other servers ## Notes - This packages installs caddy with standard [modules](https://caddyserver.com/docs/modules) only. If you need to install caddy with additional packages you need to build it with those packages included. You can use official caddy [download](https://caddyserver.com/download) page to select and build custom caddy version. Its not possible at this moment to do this via package unless it reimplements custom build.

< 2.11.4NVD

caddy

NPMcaddy =====

< 2.11.4NVD

caddy

RubyGems Caddy is an asynchronously refreshed cache that is updated on an interval to store objects that you can access quickly during requests. Caddy is great for storing information like feature flags -- accessed extremely frequently during many requests, updated relatively rarely and usually safe to be stale by some small duration.

< 2.11.4NVD

nickelser/caddy

GitHubCaddy gives you an auto-updating global cache to speed up your web requests.

< 2.11.4NVD

caddy/caddy

Docker HubUse https://hub.docker.com/_/caddy instead!

< 2.11.4NVD

caddy

Debian BookwormFast, lightweight web server with automatic HTTPS

< 2.11.4NVD

Security Advisories

CVE-2026-52846

Description

More on this CVE