CVE-2026-55458: Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Caddy’s reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades (HTTP 101 Switching Protocols). Headers including Alt-Svc, Keep-Alive, Proxy-Authenticate, Transfer-Encoding, or Trailer, which Caddy actually correctly strips for normal HTTP responses, pass through unfiltered to the client during protocol upgrades. An upstream that sets these headers (intentionally or otherwise) can inject them into client responses, enabling connection hijacking via Alt-Svc, cookie injection via Set-Cookie, and proxy authentication phishing.

The normal response path in finalizeResponse correctly strips all hop-by-hop headers before forwarding, but the 101 code path returns early, skipping the stripping entirely.