Traefik 3.7.0 → 3.7.16
15 releases · 2 breaking changes · 35 security fixes · 38 advisories fixed
35security2breaking0deprecated14feature184fix
Vulnerabilities fixed by this upgrade
- 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
- 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
- 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
- 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 7.0 GHSA-rv2h-qh7j-xrjw Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
- 7.0 GHSA-mwrr-6hp4-pxr6 Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
- 7.0 GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
- 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
- 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
- 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
- 6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 6.3 CVE-2026-88010 BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
- 7.0 CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers
- 7.0 CVE-2026-88008 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik/v3
- 9.1 CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- 8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- high GHSA-cjr6-pf59-jq29 ingress-nginx from-to-www-redirect sibling router serves the auth-protected backend without auth
- 5.3 CVE-2026-88012 respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
- 5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
- 8.2 GHSA-j994-9gqj-9hwq Same-host Ingress TLS option conflict disables client-certificate authentication
- 8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
- 9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
- 2.1 CVE-2026-71326 BasicAuth singleflight key collision allows authenticated identity spoofing
- 4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- 7.6 CVE-2026-71327 Gateway API route identity collision allows cross-namespace backend hijacking
- 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- 7.8 GHSA-8rxv-jg7p-wvg3 Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
- 5.3 CVE-2026-65601 Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
- 7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
- high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
- 6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
- medium CVE-2026-54765 Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
- 5.9 CVE-2026-54762 Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
- 7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- 7.8 CVE-2026-48491 SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
- 7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- 6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
Breaking changes
- breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
- breaking Remove retired Go Report Card badge ( @yardenshoham) in 3.7.11
Security changes
- security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
- security [security] Document the coordinated disclosure embargo for security reports ( @emilevauge) in 3.7.14
- security Advisory GHSA-qqjf-53cj-pwvv in 3.7.13
- security Advisory GHSA-f52w-8j3h-j724 in 3.7.13
- security Advisory GHSA-v67p-phpq-fc8x in 3.7.13
- security Advisory GHSA-w4v4-9rw7-5326 in 3.7.13
- security Advisory GHSA-8fcf-v89g-xpg6 in 3.7.13
- security Tell scanning agents to read the security policy and decisions pages ( @emilevauge) in 3.7.13
- security Advisory GHSA-cjr6-pf59-jq29 in 3.7.12
- security Advisory GHSA-7ghq-v6jf-g56c in 3.7.12
- security Advisory GHSA-rf44-j88r-hh8c in 3.7.12
- security [security] Document the security threat model and settled security decisions ( @emilevauge) in 3.7.12
- security Reduce SECURITY.md to a pointer to the security documentation ( @emilevauge) in 3.7.12
- security Advisory GHSA-5w68-77r2-r64c in 3.7.11
- security Advisory GHSA-g55h-rg46-x9c5 in 3.7.11
- security Advisory GHSA-j994-9gqj-9hwq in 3.7.11
- security Advisory GHSA-m6wx-622r-48r9 in 3.7.11
- security Advisory GHSA-fgjj-px3w-67xx in 3.7.10
- security Advisory GHSA-62fc-8686-hfmq in 3.7.10
- security Advisory GHSA-6765-c87h-8mrf in 3.7.10
- security Advisory GHSA-3ccp-42pg-hgv6 in 3.7.9
- security Advisory GHSA-8rxv-jg7p-wvg3 in 3.7.8
- security Advisory GHSA-cxjq-mrr5-89rv in 3.7.7
- security Advisory GHSA-42cj-m3vj-89wv in 3.7.7
- security Advisory GHSA-qq9q-x9w4-chhj in 3.7.7
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.7.6
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.7.6
- security CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) in 3.7.6
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.7.6
- security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.7.5
- security CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) in 3.7.5
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
- security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
- security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
Every release in between
fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)
fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)
other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fix[k8s/crd] Allow observability metadata on child routers ( @bunnysayzz)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ( @rtribotte)
fix[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ( @Tyagiquamar)
fix[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ( @juliens)
fix[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ( @juliens)
fix[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ( @mturac)
fix[fastproxy] Fix concurrent buffer reads on upgraded connections ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
security[security] Fix typo in the Request Path page ( @SethFalco)
other[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ( @SatvikMishra08)
other[k8s] Document the safeNaming impact on cross-provider references ( @lazerg)
other[k8s/gatewayapi] Fix broken links in the Gateway API routing page ( @Neffi42)
fixFix broken anchor links to Restrict the Scope of Service Discovery ( @SatvikMishra08)
featureAdd the documentation style guide to the Contributing section ( @rachana5)
breakingRemove redundant period in README ( @mxmrnn)
fix[acme] Bump github.com/go-acme/lego/v5 to v5.5.1 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 to v5.5.2 ( @ldez)
fix[acme] Close the newly created ACME storage file on Windows ( @datrixlab)
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[fastproxy] Isolate NTLM and Negotiate backend connections in FastProxy ( @kevinpollet)
fix[k8s/gatewayapi] Allow configuring gateways ( @kevinpollet)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.2 ( @kevinpollet)
fix[k8s/gatewayapi] Do not create the Gateway API routers a previous one shadows ( @rtribotte)
fix[k8s/gatewayapi] Do not let TLSRoute routers shadow TCPRoute routers ( @rtribotte)
fix[k8s/gatewayapi] Fix HTTP/GRPC routes conflict ( @AnatoleLucet)
fix[k8s/gatewayapi] Fix TLSRoute router name collision across listeners sharing an entry point ( @rtribotte)
fix[k8s/gatewayapi] Report the BackendTLSPolicy ancestor in the namespace of its Gateway ( @rtribotte)
fix[k8s/gatewayapi] Stable sort Gateways to keep the TLS certificate order stable ( @rl-io)
fix[k8s/ingress-nginx] Build the ssl-passthrough HTTP route like any other ingress ( @rtribotte)
fix[k8s/ingress-nginx] Do not normalize resource names in the ingress-nginx provider ( @kevinpollet)
fix[k8s/ingress-nginx] Fix the ingress-nginx cross-links between the routing and provider docs ( @simpleqt)
fix[k8s/ingress-nginx] Make trailing capture group optional in ImplementationSpecific paths ( @mmatur)
fix[k8s/ingress-nginx] Remove Authorization header for basic and digest auth ( @josmo)
fix[k8s/ingress-nginx] Set the Ssl-Client-* request headers on the Ingress-NGINX HTTP router ( @rtribotte)
fix[k8s/ingress-nginx] Support wildcard origins in cors-allow-origin for the ingress-nginx provider ( @kimsehyoung)
fix[logs, middleware, k8s/crd] Expose IngressRoute metadata in access logs ( @mmatur)
fix[middleware] Avoid deprecated table.maxn in the rate limiter Lua script ( @lazerg)
fix[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric to v1.46.0 ( @kevinpollet)
fix[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.46.0 ( @kevinpollet)
fix[otel] Bump otlploggrpc and otlploghttp to v0.22.0 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Silence encoded characters warning when some are disallowed ( @Adel-Ayoub)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Fix the second server selection bias in the P2C load balancer ( @lazerg)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)
fix[webui] Bump react-router to v7 and vite to v8 ( @gndz07)
fixFix build with GOPROXY=direct ( @mehrdadbn9)
other[accesslogs] Clarify access log buffering behavior ( @amazon7737)
security[security] Document the coordinated disclosure embargo for security reports ( @emilevauge)
feature[tcp] Fix 'allows to configure' grammar in TCP ServersTransport ( @fng713)
fixFix 'allow to match' grammar in TCP HostSNI rules ( @fng713)
fixFix case-sensitive option anchors ( @simpleqt)
fixFix the end anchor in the single-test example ( @amazon7737)
+3 more items in the release notessecurityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-v67p-phpq-fc8x
securityAdvisory GHSA-w4v4-9rw7-5326
securityAdvisory GHSA-8fcf-v89g-xpg6
fix[acme] Bump github.com/go-acme/lego/v5 to v5.4.1 ( @ldez)
fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)
fix[acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge ( @amazon7737)
fix[acme, tls] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers ( @rtribotte)
fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)
fix[k8s/ingress-nginx] Fix sticky cookie expiration per request ( @makaiver)
fix[k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect ( @mmatur)
fix[k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute ( @mmatur)
fix[logs, middleware] Set access log entry level and time before formatting the OTLP body ( @emilevauge)
fix[logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning ( @lazerg)
fix[middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme ( @AnouarMohamed)
fix[middleware, authentication] Prevent user enumeration through the basic auth singleflight key ( @sdelicata)
fix[server] Build the configuration copy once per change ( @jspdown)
fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)
fix[server] Deny request with an opaque request target ( @sdelicata)
fix[server] Do not forward request trailer values to the backend ( @rtribotte)
fix[server] Bump github.com/quic-go/quic-go to v0.62.0 ( @Nelwhix)
fix[tls] Redact duplicate TLS certificates in provider merge logs ( @xsergos)
fix[webui] Fix displayed number on details pages ( @gndz07)
feature[k8s] Add warning about Ingress API frozen state ( @jnoordsij)
other[k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector ( @jnoordsij)
other[k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs ( @thev1ndu)
securityTell scanning agents to read the security policy and decisions pages ( @emilevauge)
securityAdvisory GHSA-cjr6-pf59-jq29
securityAdvisory GHSA-7ghq-v6jf-g56c
securityAdvisory GHSA-rf44-j88r-hh8c
fix[fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 ( @mmatur)
fix[file] Include the filename in file provider configuration errors ( @lazerg)
fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)
fix[k8s] Fix typos in docs and an OCSP log message ( @MsfPablo)
fix[k8s, k8s/ingress-nginx] Fix redirect www host with a non-numeric port ( @mmatur)
fix[k8s/ingress-nginx] Fix TLS option name collision across namespaces in the ingress-nginx provider ( @gndz07)
fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)
fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)
fixBump etcd client modules to v3.5.33 ( @mmatur)
other[k8s] Update redirections block reference in basic.md ( @Larzenegger)
other[k8s] Fix formatting in Kubernetes setup guide ( @stefkiourk)
security[security] Document the security threat model and settled security decisions ( @emilevauge)
other[service] Clarify ServersTransport behavior for the errors middleware in Kubernetes ( @lazerg)
fixFix v3.7.11 migration guide ( @gndz07)
otherMove Jean-Baptiste Doumenjou and Mathieu Lonjaret to past maintainers ( @emilevauge)
securityReduce SECURITY.md to a pointer to the security documentation ( @emilevauge)
otherUpdate end of support dates ( @nmengin)
securityAdvisory GHSA-5w68-77r2-r64c
securityAdvisory GHSA-g55h-rg46-x9c5
securityAdvisory GHSA-j994-9gqj-9hwq
securityAdvisory GHSA-m6wx-622r-48r9
fix[fastproxy] Reject out-of-range status codes from backends when using FastProxy ( @gndz07)
fix[http3] Bump github.com/quic-go/quic-go to v0.61.0 ( @jnoordsij)
fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)
fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)
fix[k8s/crd] Name failover generated services after the referenced Kubernetes Service ( @rtribotte)
fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)
fix[k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( @gndz07)
fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)
fix[k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( @gndz07)
fix[k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( @rtribotte)
fix[k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( @gndz07)
fix[k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( @gndz07)
fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)
fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)
fixBump golang.org/x dependencies ( @mmatur)
other[accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( @rtribotte)
other[api] Fix doubled word in API/dashboard reference docs ( @latent-9)
other[docker] Remove :ro from docker.sock ( @bluepuma77)
other[k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( @rtribotte)
other[k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( @rtribotte)
other[k8s/ingress-nginx] Docs: Update supported server snippet directives ( @rtsui-harmonicinc)
feature[middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( @amazon7737)
other[middleware] Mark the errors middleware service option as required ( @lazerg)
other[tls] Document the TLS options conflict resolution ( @rtribotte)
other[tls] Clarify router TLS replaces entrypoint TLS ( @sornapudisuresh)
otherDocument Redis keyspace notifications requirement ( @omkar619-dev)
breakingRemove retired Go Report Card badge ( @yardenshoham)
otherRestore the systemd socket activation documentation ( @lazerg)
otherUpdate version support policy starting with v3.6 ( @nmengin)
securityAdvisory GHSA-fgjj-px3w-67xx
securityAdvisory GHSA-62fc-8686-hfmq
securityAdvisory GHSA-6765-c87h-8mrf
fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)
fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)
fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 ( @rtribotte)
other[k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider ( @gndz07)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider ( @AmariahAK)
fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
other[k8s/gatewayapi] Document Gateway API generated service names change in the migration guide ( @rtribotte)
other[k8s/ingress-nginx] Fix typo in nginx annotation proxy-buffer-numbers ( @fischerman)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-8rxv-jg7p-wvg3
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider ( @gndz07)
fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)
fix[middleware] Fix panic in retry middleware with Websockets ( @juliens)
other[k8s] Align certificateRef and indicate ports ( @veenoise)
other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)
other[k8s/crd] Fix duplicated options table in ServersTransport CRD reference ( @rachana5)
securityAdvisory GHSA-cxjq-mrr5-89rv
securityAdvisory GHSA-42cj-m3vj-89wv
securityAdvisory GHSA-qq9q-x9w4-chhj
fix[middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation ( @dfeinblatt)
fix[rules] Fix consistency between HostSNI() and Host() ( @juliens)
fix[k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace ( @gndz07)
fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)
fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)
fixFix version in migration guide ( @kevinpollet)
fixFix changelog v2.11.51 ( @mmatur)
featureAdd v3.7 to supported version docs ( @jnoordsij)
fixFix some function names in comments ( @blackflytech)
featureAdd @nandorKollar as a current maintainer ( @emilevauge)
featureAdd @amazon7737 as a current maintainer ( @emilevauge)
other[middleware] Clarify buffering middleware defaults ( @amazon7737)
fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)
fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
securityCVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)
fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates ( @nickmnt)
fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)
fix[k8s/gatewayapi] Avoid collisions for Gateway API services names ( @rtribotte)
fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)
fix[k8s/ingress-nginx] Configure retry according to buffering configuration ( @rtribotte)
fix[k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream ( @carloslima)
fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)
fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)
fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)
fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses ( @AnatoleLucet)
fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)
fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)
fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)
fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)
fix[server] Add an option to remove request headers with underscores ( @youkoulayley)
fix[server] Configurable max request header size ( @juliens)
fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)
other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)
other[k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation ( @jnoordsij)
feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)
other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)
other[middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers ( @rtribotte)
other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
featureAdds documentations on maxHeaderBytes ( @juliens)
fixFix inaccuracies in reference documentation ( @sheddy-traefik)
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)
fix[k8s/ingress-nginx] Skip ingress when auth-secret resolution fails ( @gndz07)
fix[k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider ( @Learloj)
fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)
fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)
fix[webui] Bump react-router and jsdom ( @gndz07)
fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)
securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)
fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)
fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)
fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)
fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)
fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)
fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)
fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)
fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)
other[file] Replace generated File routing reference page ( @sheddy-traefik)
other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)
other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)
otherPolish grammar in migration guides ( @quyentonndbs)
other[middleware] Remove whitespace in HTML tag ( @marbon87)
featureAdd @LBF38 as a current maintainer ( @emilevauge)
featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)
feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)
other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)