Is Caddy v2.11.8 safe to update?

Not without preparation. Important security update with real breaking changes, though most setups won't notice. Run caddy validate on your config before restarting, and if you serve PHP, test that directory URLs still load (there's an open report of 404s on paths ending in /).

What users are reporting

1 public report(s) mention this version, none clearly describing breakage. Most-discussed: “2.11.8: php_fastcgi returns 404 for directory URLs ending in / (index.php not served)”. Sources: GitHub · checked 2026-11-04

• 2.11.8: php_fastcgi returns 404 for directory URLs ending in / (index.php not served) (GitHub)

Reports are from public issue trackers and forums. Their count isn't a failure rate, and an empty list doesn't prove an update is safe.

⚠️ What breaks

The release notes flag breaking or backward-incompatible changes. Something in your setup may stop working until you change config. Read the items below and the full notes before upgrading.

From the release notes

• Release notes list breaking changes: invalid or dots-only Host headers now get 400, request_body max_size rejects oversized Content-Length with 413 up front, and try_files candidates ending in / only match directories.
• Release notes: php_fastcgi sites without index.php now send missing paths to PHP, and stricter config validation turns some silently ignored settings (e.g. TLS1.3 instead of tls1.3, multiple expression lines) into startup errors.
• Release notes: several security fixes (path traversal via Host in file paths, FastCGI script path confusion); Caddy recommends upgrading, especially for PHP sites or {host} in paths.

Read the full official release notes →

✅ What to do first

1. Read the official release notes (linked in “What breaks”).
2. Back up config and data (snapshot the VM/volume if you can).
3. Note the version you are on now, so you can roll back.
4. Update, then check logs and core functions before walking away.

↩️ How to roll back to v2.11.7

Docker: snapshot/back up the data volumes first, then if needed change the tag back, e.g. image: caddy:v2.11.7, and run docker compose up -d. Tag format varies by image (some drop the “v”), so check the registry’s tag list.