SHSelfHostIndex
CO

Coraza WAF

Open-source enterprise-grade web application firewall

Reverse Proxy & Gateways ★ 3.9k stars Medium setup Apache-2.0

Coraza is an open-source, high-performance web application firewall library compatible with ModSecurity rules and the OWASP Core Rule Set. It is embedded into self-hosted proxies such as Caddy and Traefik.

Official siteSource code

Key features

  • ModSecurity-compatible
  • OWASP CRS support
  • High performance
  • Embeddable WAF

Strengths

  • Released under the Apache-2.0 license
  • Active community (3.9k GitHub stars)
  • Written in Go
  • Tiny footprint — runs in 128 MB RAM

Is Coraza WAF secure?

No known vulnerabilities affect Coraza WAF's latest release (v3.8.1). OSV.dev lists 11 past advisories for the project; none of them applies to this release. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

  • Most recent fixed advisory CVE-2026-41510, published 2026-10-12 (2 days ago), fixed in 3.8.1

Source: OSV.dev, checked 2026-10-14. How this is measured.

Coraza WAF replaces

Self-hosted ModSecurity alternativesSelf-hosted Cloudflare WAF alternatives

Health badge

Maintain Coraza WAF? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 91 · excellent

Markdown
[![SelfHostIndex health score for Coraza WAF](https://selfhostindex.com/badge/coraza-waf.svg)](https://selfhostindex.com/app/coraza-waf/)
HTML
<a href="https://selfhostindex.com/app/coraza-waf/"><img src="https://selfhostindex.com/badge/coraza-waf.svg" alt="SelfHostIndex health score for Coraza WAF"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/coraza-waf.svg
   :alt: SelfHostIndex health score for Coraza WAF
   :target: https://selfhostindex.com/app/coraza-waf/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare Coraza WAF

3 head-to-head comparisons.

Similar reverse proxy & gateways apps