CVE-2026-55458

Caddy 's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Specifically, the finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go returns early for 101 status codes, bypassing the ...