关键漏洞信息 Security Patches fastcgi: CVE-2026-27590 Unicode case-folding length expansion causes incorrect (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport. admin: CVE-2026-27589 Cross-origin requests attempted with mode could cause some API requests to succeed; such requests are now blocked. caddyhttp: CVE-2026-27588 The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass. caddyhttp: CVE-2026-27587 The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass. caddytls: CVE-2026-27586 TLS client authentication silently fails open when CA certificate file is missing or malformed. caddyhttp: CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections. ``` 这些漏洞描述了在Caddy 2.11.0版本中发现的安全问题，并说明了它们的影响和修复方法。建议用户及时更新到最新版本，以确保系统的安全性。