---
type: "post"
id: "rfc-7230-6-1-compliance-issue-hop-by-6c9c29"
slug: "rfc-7230-6-1-compliance-issue-hop-by-6c9c29"
title: "RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through · Advisory · caddyserver/caddy · GitHub"
description: "Caddy published GitHub Security Advisory GHSA-8qx7-j2v2-x6q5 on October 13, 2026."
retrieval_nugget: "Caddy published GitHub Security Advisory GHSA-8qx7-j2v2-x6q5 on October 13, 2026."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["github"]
entities: ["Caddy","Caddy Server","RFC 7230"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "A Caddy advisory reports a separate hop-by-hop header leakage issue, affecting versions through v2.11.4 and patched in v2.11.5."
prior_refs: []
source_url: "https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5"
source_urls: ["https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:rfc-7230-6-1-compliance-issue-hop-by-6c9c29"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/rfc-7230-6-1-compliance-issue-hop-by-6c9c29/","markdown":"https://newruntime.com/posts/rfc-7230-6-1-compliance-issue-hop-by-6c9c29.md","json":"https://newruntime.com/posts/rfc-7230-6-1-compliance-issue-hop-by-6c9c29.json"}
---

# RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through · Advisory · caddyserver/caddy · GitHub

## Retrieval answer

Caddy published GitHub Security Advisory GHSA-8qx7-j2v2-x6q5 on October 13, 2026.

Caddy published GitHub Security Advisory GHSA-8qx7-j2v2-x6q5 on October 13, 2026. It describes a reverse-proxy issue in which hop-by-hop headers from an upstream response can pass through Caddy during a WebSocket upgrade.

The advisory lists Caddy versions through v2.11.4 as affected and v2.11.5 as patched. On the HTTP 101 Switching Protocols path, Caddy returns before the header-removal logic used for normal responses. The source names headers including Alt-Svc, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, and Trailer.

According to the advisory, HTTP/2 and HTTP/3 WebSocket handling can convert the upstream 101 response into a 200 response for clients. The report describes possible header injection consequences and identifies CWE-444 as the closest fit. It does not establish that any deployment was exploited or that a particular upstream application has been compromised.

Source: https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)