Traefik 3.6.12 → 3.7.13

25 releases · 5 breaking changes · 62 security fixes · 27 advisories fixed

62security5breaking1deprecated49feature226fix

Is 3.6.12 affected? · What changed up to 3.7.16

Vulnerabilities fixed by this upgrade

6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
6.3 CVE-2026-88010 BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
7.0 CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers
7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
9.1 CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
5.3 CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
2.1 CVE-2026-71326 BasicAuth singleflight key collision allows authenticated identity spoofing
4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
7.6 CVE-2026-71327 Gateway API route identity collision allows cross-namespace backend hijacking
7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
7.8 CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
7.8 CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
7.8 CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
6.3 CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
4.8 CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Breaking changes

breaking Remove retired Go Report Card badge ( @yardenshoham) in 3.7.11
breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.7.0
breaking Add a Breaking change note to the changelog ( @nmengin) in 3.7.0
breaking Remove extra dots in migration guide ( @rtribotte) in 3.7.0
breaking Remove extraneous dots in migration guide ( @dathbe) in 3.7.0

Security changes

security Advisory GHSA-qqjf-53cj-pwvv in 3.7.13
security Advisory GHSA-f52w-8j3h-j724 in 3.7.13
security Advisory GHSA-v67p-phpq-fc8x in 3.7.13
security Advisory GHSA-w4v4-9rw7-5326 in 3.7.13
security Advisory GHSA-2272-4vv8-65ww in 3.7.13
security Advisory GHSA-8fcf-v89g-xpg6 in 3.7.13
security Tell scanning agents to read the security policy and decisions pages ( @emilevauge) in 3.7.13
security Advisory GHSA-cjr6-pf59-jq29 in 3.7.12
security Advisory GHSA-7ghq-v6jf-g56c in 3.7.12
security Advisory GHSA-rf44-j88r-hh8c in 3.7.12
security [security] Document the security threat model and settled security decisions ( @emilevauge) in 3.7.12
security Reduce SECURITY.md to a pointer to the security documentation ( @emilevauge) in 3.7.12
security Advisory GHSA-5w68-77r2-r64c in 3.7.11
security Advisory GHSA-g55h-rg46-x9c5 in 3.7.11
security Advisory GHSA-j994-9gqj-9hwq in 3.7.11
security Advisory GHSA-m6wx-622r-48r9 in 3.7.11
security Advisory GHSA-fgjj-px3w-67xx in 3.7.10
security Advisory GHSA-62fc-8686-hfmq in 3.7.10
security Advisory GHSA-6765-c87h-8mrf in 3.7.10
security Advisory GHSA-3ccp-42pg-hgv6 in 3.7.9
security Advisory GHSA-8rxv-jg7p-wvg3 in 3.7.8
security Advisory GHSA-cxjq-mrr5-89rv in 3.7.7
security Advisory GHSA-42cj-m3vj-89wv in 3.7.7
security Advisory GHSA-qq9q-x9w4-chhj in 3.7.7
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.7.6
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.7.6
security CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) in 3.7.6
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.7.6
security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.7.5
security CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) in 3.7.5
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
security Advisory GHSA-rh7m-2m44-x32f in 3.7.1
security Update vulnerability submission guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the multi tenant security note ( @nmengin) in 3.7.0
security Add vulnerability submission quality guidelines ( @emilevauge) in 3.7.0
security [k8s] Improve the K8S multi-tenancy security note ( @nmengin) in 3.7.0
security Bring back security section on API & Dashboard documentation page ( @gndz07) in 3.7.0
security Update SECURITY.md ( @cwayne18) in 3.7.0
security Update SECURITY.md to streamline information ( @emilevauge) in 3.7.0
security Advisory GHSA-fgjj-px3w-67xx in 3.6.25
security Advisory GHSA-62fc-8686-hfmq in 3.6.25
security Advisory GHSA-6765-c87h-8mrf in 3.6.25
security Advisory GHSA-3ccp-42pg-hgv6 in 3.6.24
security Advisory GHSA-cxjq-mrr5-89rv in 3.6.23
security Advisory GHSA-42cj-m3vj-89wv in 3.6.23
security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.6.22
security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.6.22
security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.6.22
security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.6.21
security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.6.19
security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.6.17
security Advisory GHSA-rh7m-2m44-x32f in 3.6.17
security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 3.6.15
security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 3.6.14
security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 3.6.14
security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 3.6.14
security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 3.6.14
security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 3.6.14
security Update vulnerability submission guidelines ( @emilevauge) in 3.6.14

Deprecations

deprecated Fix migration guide URLs in deprecation notice ( @alexmar07) in 3.7.0

Every release in between

3.7.13 Sep 4, 2026 Release notes ↗

securityAdvisory GHSA-qqjf-53cj-pwvv

securityAdvisory GHSA-f52w-8j3h-j724

securityAdvisory GHSA-v67p-phpq-fc8x

securityAdvisory GHSA-w4v4-9rw7-5326

securityAdvisory GHSA-2272-4vv8-65ww

securityAdvisory GHSA-8fcf-v89g-xpg6

fix[acme] Bump github.com/go-acme/lego/v5 to v5.4.1 ( @ldez)

fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)

fix[acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge ( @amazon7737)

fix[acme, tls] Ignore negated matchers when parsing rule domains ( @rtribotte)

fix[consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers ( @rtribotte)

fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)

fix[k8s/ingress-nginx] Fix sticky cookie expiration per request ( @makaiver)

fix[k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect ( @mmatur)

fix[k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute ( @mmatur)

fix[logs, middleware] Set access log entry level and time before formatting the OTLP body ( @emilevauge)

fix[logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning ( @lazerg)

fix[middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme ( @AnouarMohamed)

fix[middleware, authentication] Prevent user enumeration through the basic auth singleflight key ( @sdelicata)

fix[server] Build the configuration copy once per change ( @jspdown)

fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)

fix[server] Deny request with an opaque request target ( @sdelicata)

fix[server] Do not forward request trailer values to the backend ( @rtribotte)

fix[server] Bump github.com/quic-go/quic-go to v0.62.0 ( @Nelwhix)

fix[tls] Redact duplicate TLS certificates in provider merge logs ( @xsergos)

fix[webui] Fix displayed number on details pages ( @gndz07)

feature[k8s] Add warning about Ingress API frozen state ( @jnoordsij)

other[k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector ( @jnoordsij)

other[k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs ( @thev1ndu)

securityTell scanning agents to read the security policy and decisions pages ( @emilevauge)

3.7.12 Aug 26, 2026 Release notes ↗

securityAdvisory GHSA-cjr6-pf59-jq29

securityAdvisory GHSA-7ghq-v6jf-g56c

securityAdvisory GHSA-rf44-j88r-hh8c

fix[fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 ( @mmatur)

fix[file] Include the filename in file provider configuration errors ( @lazerg)

fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)

fix[k8s] Fix typos in docs and an OCSP log message ( @MsfPablo)

fix[k8s, k8s/ingress-nginx] Fix redirect www host with a non-numeric port ( @mmatur)

fix[k8s/ingress-nginx] Fix TLS option name collision across namespaces in the ingress-nginx provider ( @gndz07)

fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)

fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)

fixBump etcd client modules to v3.5.33 ( @mmatur)

other[k8s] Update redirections block reference in basic.md ( @Larzenegger)

other[k8s] Fix formatting in Kubernetes setup guide ( @stefkiourk)

security[security] Document the security threat model and settled security decisions ( @emilevauge)

other[service] Clarify ServersTransport behavior for the errors middleware in Kubernetes ( @lazerg)

fixFix v3.7.11 migration guide ( @gndz07)

otherMove Jean-Baptiste Doumenjou and Mathieu Lonjaret to past maintainers ( @emilevauge)

securityReduce SECURITY.md to a pointer to the security documentation ( @emilevauge)

otherUpdate end of support dates ( @nmengin)

3.7.11 Aug 19, 2026 Release notes ↗

securityAdvisory GHSA-5w68-77r2-r64c

securityAdvisory GHSA-g55h-rg46-x9c5

securityAdvisory GHSA-j994-9gqj-9hwq

securityAdvisory GHSA-m6wx-622r-48r9

fix[fastproxy] Reject out-of-range status codes from backends when using FastProxy ( @gndz07)

fix[http3] Bump github.com/quic-go/quic-go to v0.61.0 ( @jnoordsij)

fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)

fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)

fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)

fix[k8s/crd] Name failover generated services after the referenced Kubernetes Service ( @rtribotte)

fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)

fix[k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( @gndz07)

fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)

fix[k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( @gndz07)

fix[k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( @rtribotte)

fix[k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( @gndz07)

fix[k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( @gndz07)

fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)

fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)

fixBump golang.org/x dependencies ( @mmatur)

other[accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( @rtribotte)

other[api] Fix doubled word in API/dashboard reference docs ( @latent-9)

other[docker] Remove :ro from docker.sock ( @bluepuma77)

other[k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( @rtribotte)

other[k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( @rtribotte)

other[k8s/ingress-nginx] Docs: Update supported server snippet directives ( @rtsui-harmonicinc)

feature[middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( @amazon7737)

other[middleware] Mark the errors middleware service option as required ( @lazerg)

other[tls] Document the TLS options conflict resolution ( @rtribotte)

other[tls] Clarify router TLS replaces entrypoint TLS ( @sornapudisuresh)

otherDocument Redis keyspace notifications requirement ( @omkar619-dev)

breakingRemove retired Go Report Card badge ( @yardenshoham)

otherRestore the systemd socket activation documentation ( @lazerg)

otherUpdate version support policy starting with v3.6 ( @nmengin)

3.7.10 Jul 31, 2026 Release notes ↗

securityAdvisory GHSA-fgjj-px3w-67xx

securityAdvisory GHSA-62fc-8686-hfmq

securityAdvisory GHSA-6765-c87h-8mrf

fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)

fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)

fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)

fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)

fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)

fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)

fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)

fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 ( @rtribotte)

other[k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider ( @gndz07)

3.7.9 Jul 24, 2026 Release notes ↗

securityAdvisory GHSA-3ccp-42pg-hgv6

fix[k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider ( @AmariahAK)

fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)

fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)

fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)

fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)

fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)

other[k8s/gatewayapi] Document Gateway API generated service names change in the migration guide ( @rtribotte)

other[k8s/ingress-nginx] Fix typo in nginx annotation proxy-buffer-numbers ( @fischerman)

featureAdd a migration note for CONNECT requests ( @kevinpollet)

3.7.8 Jul 15, 2026 Release notes ↗

securityAdvisory GHSA-8rxv-jg7p-wvg3

fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)

fix[k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider ( @gndz07)

fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)

fix[middleware] Fix panic in retry middleware with Websockets ( @juliens)

other[k8s] Align certificateRef and indicate ports ( @veenoise)

other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)

other[k8s/crd] Fix duplicated options table in ServersTransport CRD reference ( @rachana5)

3.7.7 Jul 8, 2026 Release notes ↗

securityAdvisory GHSA-cxjq-mrr5-89rv

securityAdvisory GHSA-42cj-m3vj-89wv

securityAdvisory GHSA-qq9q-x9w4-chhj

fix[middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation ( @dfeinblatt)

fix[rules] Fix consistency between HostSNI() and Host() ( @juliens)

fix[k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace ( @gndz07)

fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)

fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)

fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)

fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)

fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)

fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)

fixFix version in migration guide ( @kevinpollet)

fixFix changelog v2.11.51 ( @mmatur)

featureAdd v3.7 to supported version docs ( @jnoordsij)

fixFix some function names in comments ( @blackflytech)

featureAdd @nandorKollar as a current maintainer ( @emilevauge)

featureAdd @amazon7737 as a current maintainer ( @emilevauge)

other[middleware] Clarify buffering middleware defaults ( @amazon7737)

fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)

fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)

3.7.6 Jun 30, 2026 Release notes ↗

securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)

securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

securityCVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)

fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)

fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)

fix[k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates ( @nickmnt)

fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)

fix[k8s/gatewayapi] Avoid collisions for Gateway API services names ( @rtribotte)

fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)

fix[k8s/ingress-nginx] Configure retry according to buffering configuration ( @rtribotte)

fix[k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream ( @carloslima)

fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)

fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)

fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)

fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)

fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)

fix[middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses ( @AnatoleLucet)

fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)

fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)

fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)

fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)

fix[server] Add an option to remove request headers with underscores ( @youkoulayley)

fix[server] Configurable max request header size ( @juliens)

fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)

fix[webui] Bump axios to v1.18.0 ( @gndz07)

fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)

other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)

other[k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation ( @jnoordsij)

feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)

other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)

other[middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers ( @rtribotte)

other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)

security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)

featureAdds documentations on maxHeaderBytes ( @juliens)

fixFix inaccuracies in reference documentation ( @sheddy-traefik)

3.7.5 Jun 10, 2026 Release notes ↗

securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)

securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)

fix[k8s/ingress-nginx] Skip ingress when auth-secret resolution fails ( @gndz07)

fix[k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider ( @Learloj)

fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)

fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)

fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)

fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)

3.7.4 Jun 5, 2026 Release notes ↗

fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)

fix[webui] Bump react-router and jsdom ( @gndz07)

fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)

fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)

fix[webui] Bump axios to v1.17.0 ( @gndz07)

fix[tls] Fix snicheck with keepalive ( @juliens)

3.7.3 Jun 4, 2026 Release notes ↗

securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)

securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)

securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)

fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)

fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)

fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)

fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)

fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)

fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)

fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)

fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)

fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)

fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)

fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)

fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)

fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)

fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)

fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)

fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)

fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)

feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)

other[file] Replace generated File routing reference page ( @sheddy-traefik)

other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)

other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)

otherPolish grammar in migration guides ( @quyentonndbs)

other[middleware] Remove whitespace in HTML tag ( @marbon87)

featureAdd @LBF38 as a current maintainer ( @emilevauge)

featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)

other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)

3.7.1 May 11, 2026 Release notes ↗

securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)

securityAdvisory GHSA-rh7m-2m44-x32f

fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)

fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)

3.7.0 May 5, 2026 Release notes ↗

feature[k8s/ingress-nginx] Use a metamodel to generate dynamic configuration in ingress-nginx ( @juliens)

feature[k8s/ingress-nginx] Add limit-connections support ( @amazon7737)

feature[webui] Display server weight in service detail view ( @murataslan1)

feature[webui, tls] Add certificates menu and overview ( @holomekc)

feature[provider] Add providers routing precedence configuration ( @juliens)

feature[k8s/ingress-nginx] Support NGINX global auth annotation ( @foxcool)

feature[k8s/ingress-nginx] Add limit-burst-multiplier annotation support ( @amazon7737)

feature[k8s/ingress-nginx, k8s/ingress, rules] Add wildcard host in Host and HostSNI matchers ( @juliens)

feature[k8s/gatewayapi] Support multiple certificateRefs on gateway listeners ( @mortennordbye)

feature[k8s/gatewayapi] Add secret support for BackendTLSPolicy caCertificateRefs ( @kevinpollet)

feature[accesslogs, k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/enable-access-log annotation ( @ris-tlp)

feature[accesslogs, k8s/ingress-nginx, k8s/ingress] Add Kubernetes Ingress logs fields ( @rtribotte)

feature[k8s/knative] Support knative v1.20.0 ( @idurgakalyan)

feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.5.1 ( @mmatur)

feature[k8s/ingress-nginx, middleware, authentication] Add support for auth-snippet ( @juliens)

feature[accesslogs, otel] Allow Stdio access logs alongsige OTLP logging ( @Mulgish)

feature[acme] Add CertificateTimeout ACME configuration option ( @ceko)

feature[k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/allowlist-source-range ( @ris-tlp)

feature[k8s/crd] Add ingressClassName field to the CRDs spec ( @kkrypt0nn)

feature[k8s/crd] Service failover support in TraefikService CRD ( @jspdown)

feature[k8s/crd, service] Support cipher suites configuration with ServersTransport ( @NEwa-05)

feature[k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi] Services middleware and Gateway API filters on HTTP backends ( @juliens)

feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation ( @gndz07)

feature[k8s/ingress-nginx] Add rewrite-target nginx annotations support ( @LBF38)

feature[k8s/ingress-nginx] Add support for app-root nginx annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for auth-signin annotation ( @DesalLama)

feature[k8s/ingress-nginx] Add support for from-to-www-redirect NGINX annotation ( @LBF38)

feature[k8s/ingress-nginx] Add support for proxy-read-timeout and proxy-send-timeout NGINX annotations ( @LBF38)

securityUpdate vulnerability submission guidelines ( @emilevauge)

security[k8s] Improve the multi tenant security note ( @nmengin)

securityAdd vulnerability submission quality guidelines ( @emilevauge)

breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)

security[k8s] Improve the K8S multi-tenancy security note ( @nmengin)

breakingAdd a Breaking change note to the changelog ( @nmengin)

securityBring back security section on API & Dashboard documentation page ( @gndz07)

deprecatedFix migration guide URLs in deprecation notice ( @alexmar07)

breakingRemove extra dots in migration guide ( @rtribotte)

breakingRemove extraneous dots in migration guide ( @dathbe)

securityUpdate SECURITY.md ( @cwayne18)

securityUpdate SECURITY.md to streamline information ( @emilevauge)

+242 more items in the release notes

3.6.25 Jul 31, 2026 Release notes ↗