# Caddy 2.11.7 fixes reverse-proxy crashes and one-minute SSE disconnects

Caddy's October 3 patch repairs regressions introduced by 2.11.6 that could crash HTTP/2 reverse proxies or terminate quiet streaming connections after a minute. It also implements the standards-track Incremental header for streamed HTTP messages.

Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.

- Status: Active
- Published: 2026-10-12T17:57:25+13:00
- Updated: 2026-10-12T17:57:25+13:00
- Categories: Web Development, Cloud & Infrastructure, Deployment & DevOps, Developer Tools
- Tags: Caddy, HTTP standards, HTTP/2, reverse proxy, self-hosting, Server-Sent Events
- Canonical HTML: https://beyondthe.news/dossiers/caddy-2-11-7-http2-proxy-sse-timeout-incremental-rfc10036

## What changed

Caddy 2.11.7, released October 3, 2026, fixes three related regressions from the default idle read/write deadlines introduced in 2.11.6. Under HTTP/2, a reverse proxy still reading a request body after its handler returned could trigger a nil-pointer panic. Under HTTP/1.1, POST-based SSE responses could terminate exactly 60 seconds after the request body was read. Separately, HTTP/2 SSE streams with more than a minute between writes could be reset because the idle writer incorrectly treated silence between writes as a stalled write. The patch also supports the IETF's RFC 10036 Incremental header, allowing an upstream to request immediate forwarding with `Incremental: ?1`. Configured buffering incompatible with this request now produces an explicit HTTP 501 instead of silently buffering.

## Why it matters

SSE and long-lived HTTP responses support live dashboards, coding-agent progress and AI token streaming. A proxy patch that breaks these flows only after a minute of quiet traffic is easily misdiagnosed as an application or network problem. For Caddy 2.11.6 operators, upgrading is a concrete reliability fix. RFC 10036 introduces a standards-based alternative to proxy-specific buffering controls, but unsupported intermediaries may still buffer. The release documents a crash but does not establish security exploitability or incident prevalence.

## The one-minute streaming failures

Caddy 2.11.6 introduced default one-minute idle read/write timeouts. A request-body deadline could survive beyond its owning handler, producing an HTTP/2 nil-pointer panic or severing HTTP/1.1 POST-based SSE. A separate HTTP/2 issue counted gaps between writes as idle writer time and reset otherwise healthy streams. Upstream PRs #8107 and #8119 repair these failures.

## Independent SSE reproduction

An independent Docker comparison tested SSE responses with 70 seconds of upstream silence using GET and POST over HTTP/1.1 and HTTP/2. The tester reported three of four variants were interrupted at approximately 60 seconds on Caddy 2.11.6, while 2.11.4 and 2.11.7 allowed all four to finish. This is a narrow reproducibility check, not a general reliability benchmark.

## Incremental: ?1 and RFC 10036

The IETF published RFC 10036 as a Standards Track document in August 2026. Caddy 2.11.7 uses `Incremental: ?1` to forward streamed upstream responses promptly through reverse_proxy and encode. If configured request_buffers or response_buffers prevent this, it returns 501 with Proxy-Status information. The standard explicitly warns that proxies lacking support can still buffer.

## Additional compatibility fixes

The release restores empty output for absent cookie and TLS placeholders, preserves separate Set-Cookie headers, cleans up old Unix sockets after reload, and reduces TLS handshake work under particular conditions. It does not revert all 2.11.6 changes, including stricter default limits.

## Key details

- Caddy 2.11.7 was released October 3, 2026; maintainers recommend upgrading from 2.11.6.
- Fixes HTTP/2 reverse-proxy nil-pointer panic tied to request-body deadline ownership.
- Fixes HTTP/1.1 POST SSE cutoff at 60 seconds and quiet HTTP/2 stream resets.
- Independent Docker tests reproduced SSE failures in 2.11.6 but not 2.11.7.
- Implements RFC 10036 `Incremental: ?1` for immediate streaming through supported intermediaries.
- Incompatible request/response buffering can trigger HTTP 501 with Proxy-Status.
- Also fixes Set-Cookie separation, missing placeholders and Unix socket cleanup.

## Builder takeaways

- If SSE disconnects began at almost exactly 60 seconds after a Caddy 2.11.6 upgrade, check the proxy before changing application heartbeat logic.
- Upgrade affected 2.11.6 installations to 2.11.7 and test GET/POST SSE across HTTP/1.1 and HTTP/2.
- Test the full proxy chain: Incremental only helps where intermediaries implement it.
- Audit custom buffering settings before relying on `Incremental: ?1`; an explicit 501 can result.
- Do not treat the upstream TLS performance figures as universal application benchmarks.

## What to watch

- Further Caddy fixes to idle-timeout or header-limit behaviour.
- RFC 10036 adoption by other proxies and CDNs.
- Reports of buffering incompatibilities with Incremental forwarding.

## Uncertainties

- Release notes do not establish security exploitability or incident counts.
- Independent reproduction covers a limited Docker test matrix, not every deployment.
- Not every HTTP intermediary understands Incremental.
- Other Caddy 2.11.6 default changes remain after upgrading.

## Sources

- [Caddy v2.11.7 release notes](https://github.com/caddyserver/caddy/releases/tag/v2.11.7) — Caddy · primary release notes · 2026-10-03T00:00:00+13:00. Regression fixes, upgrade guidance and RFC support.
- [Caddy request-body deadline fix #8107](https://github.com/caddyserver/caddy/pull/8107) — Caddy · primary source change · 2026-10-03T00:00:00+13:00. Fixes deadline ownership and proxy failure.
- [Caddy HTTP/2 idle writer fix #8119](https://github.com/caddyserver/caddy/pull/8119) — Caddy · primary source change · 2026-10-03T00:00:00+13:00. Fixes quiet streaming response reset.
- [RFC 10036: Incremental Forwarding of HTTP Messages](https://www.rfc-editor.org/rfc/rfc10036.html) — IETF RFC Editor · primary standard · 2026-08-01T00:00:00+12:00. Normative header and rejection semantics.
- [Independent Caddy 2.11.6 and 2.11.7 SSE Docker comparison](https://note.com/tane_log/n/n874758a5cda7?hl=en) — Tane · independent testing · 2026-10-04T00:00:00+13:00. Four SSE cases with 70 seconds of silence.