# Traefik changelog > A cloud-native application proxy. - Vendor: Traefik Labs - Category: Developer Tools - Official site: https://traefik.io - Tracked by: What's New (https://whatsnew.fyi/product/traefik) - Harvested from: GitHub (traefik/traefik) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v3.7.10 - Date: 2026-07-31 - Version: v3.7.10 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.7.10 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.7.10 - **security** — Fix CVE GHSA-fgjj-px3w-67xx - **security** — Fix CVE GHSA-62fc-8686-hfmq - **security** — Fix CVE GHSA-6765-c87h-8mrf - **fixed** — Fix auth singleflight key collision in middleware authentication - **fixed** — Avoid router name collisions in Kubernetes Gateway API provider - **fixed** — Fix cross-namespace service reference check in Kubernetes CRD provider **CVE fixed:** - Advisory [GHSA-fgjj-px3w-67xx](https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx) - Advisory [GHSA-62fc-8686-hfmq](https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq) - Advisory [GHSA-6765-c87h-8mrf](https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf) **Bug fixes:** - **[acme]** Bump github.com/go-acme/lego/v5 to v5.3.1 ([#13547](https://github.com/traefik/traefik/pull/13547) @ldez) - **[middleware, authentication]** Fix auth singleflight key collision ([#13572](https://github.com/traefik/traefik/pull/13572) @mmatur) - **[k8s/gatewayapi]** Avoid router name collisions in Kubernetes Gateway API provider ([#13580](https://github.com/traefik/traefik/pull/13580) @gndz07) - **[tracing]** Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ([#13530](https://github.com/traefik/traefik/pull/13530) @kevinpollet) - Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ([#13574](https://github.com/traefik/traefik/pull/13574) @mmatur) - **[k8s/crd]** Fix cross-namespace service reference check in Kubernetes CRD provider ([#13573](https://github.com/traefik/traefik/pull/13573) @gndz07) - **[middleware]** Bump github.com/klauspost/compress to v1.18.7 ([#13587](https://github.com/traefik/traefik/pull/13587) @mmatur) - **[k8s/gatewayapi]** Bump sigs.k8s.io/gateway-api to v1.6.1 ([#13589](https://github.com/traefik/traefik/pull/13589) @rtribotte) **Documentation:** - **[k8s/ingress-nginx]** Clarify auth-url/rewrite-target interaction on ingress-nginx provider ([#13607](https://github.com/traefik/traefik/pull/13607) @gndz07) ### v3.6.25 - Date: 2026-07-31 - Version: v3.6.25 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.6.25 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.6.25 - **security** — Fix CVE GHSA-fgjj-px3w-67xx - **security** — Fix CVE GHSA-62fc-8686-hfmq - **security** — Fix CVE GHSA-6765-c87h-8mrf - **fixed** — Fix auth singleflight key collision in middleware authentication - **fixed** — Avoid router name collisions in Kubernetes Gateway API provider - **fixed** — Fix cross-namespace service reference check in Kubernetes CRD provider **CVE fixed:** - Advisory [GHSA-fgjj-px3w-67xx](https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx) - Advisory [GHSA-62fc-8686-hfmq](https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq) - Advisory [GHSA-6765-c87h-8mrf](https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf) **Bug fixes:** - **[acme]** Bump github.com/go-acme/lego/v5 to v5.3.1 ([#13547](https://github.com/traefik/traefik/pull/13547) @ldez) - **[middleware, authentication]** Fix auth singleflight key collision ([#13572](https://github.com/traefik/traefik/pull/13572) @mmatur) - **[k8s/gatewayapi]** Avoid router name collisions in Kubernetes Gateway API provider ([#13580](https://github.com/traefik/traefik/pull/13580) @gndz07) - **[tracing]** Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ([#13530](https://github.com/traefik/traefik/pull/13530) @kevinpollet) - Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ([#13574](https://github.com/traefik/traefik/pull/13574) @mmatur) - **[k8s/crd]** Fix cross-namespace service reference check in Kubernetes CRD provider ([#13573](https://github.com/traefik/traefik/pull/13573) @gndz07) - **[middleware]** Bump github.com/klauspost/compress to v1.18.7 ([#13587](https://github.com/traefik/traefik/pull/13587) @mmatur) ### v2.11.54 - Date: 2026-07-31 - Version: v2.11.54 - Original notes: https://github.com/traefik/traefik/releases/tag/v2.11.54 - Permalink: https://whatsnew.fyi/product/traefik/releases/v2.11.54 - **security** — Fix advisory GHSA-62fc-8686-hfmq - **fixed** — Fix cross-namespace service reference check in Kubernetes CRD provider - **changed** — Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 - **changed** — Bump golang.org/x/text to v0.40.0 and golang.org/x/net to v0.57.0 - **changed** — Bump github.com/klauspost/compress to v1.18.7 **CVE fixed:** - Advisory [GHSA-62fc-8686-hfmq](https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq) **Bug fixes:** - **[tracing]** Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ([#13530](https://github.com/traefik/traefik/pull/13530) @kevinpollet) - Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ([#13574](https://github.com/traefik/traefik/pull/13574) @mmatur) - **[k8s/crd]** Fix cross-namespace service reference check in Kubernetes CRD provider ([#13573](https://github.com/traefik/traefik/pull/13573) @gndz07) - **[middleware]** Bump github.com/klauspost/compress to v1.18.7 ([#13587](https://github.com/traefik/traefik/pull/13587) @mmatur) ### v3.7.9 - Date: 2026-07-24 - Version: v3.7.9 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.7.9 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.7.9 - **security** — Fix advisory GHSA-3ccp-42pg-hgv6 - **fixed** — Fix redirect with use-regex in IngressNGINX provider - **fixed** — Disable Zstd support in the gzhttp wrapper - **fixed** — Defer the CONNECT payload until the backend accepts the tunnel - **fixed** — Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy - **changed** — Bump google.golang.org/grpc to v1.82.1 - **fixed** — Do not add back CONNECT requests to the pool **Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.7/migrate/v3/#v379). **CVE fixed:** - Advisory [GHSA-3ccp-42pg-hgv6](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6) **Bug fixes:** - **[k8s/ingress-nginx]** Fix redirect with use-regex in IngressNGINX provider ([#13476](https://github.com/traefik/traefik/pull/13476) @AmariahAK) - **[middleware]** Disable Zstd support in the gzhttp wrapper ([#13533](https://github.com/traefik/traefik/pull/13533) @kevinpollet) - **[server]** Defer the CONNECT payload until the backend accepts the tunnel ([#13542](https://github.com/traefik/traefik/pull/13542) @sdelicata) - **[server]** Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ([#13543](https://github.com/traefik/traefik/pull/13543) @sdelicata) - **[server]** Bump google.golang.org/grpc to v1.82.1 ([#13551](https://github.com/traefik/traefik/pull/13551) @piscue) - **[server]** Do not add back CONNECT requests to the pool ([#13556](https://github.com/traefik/traefik/pull/13556) @kevinpollet) **Documentation:** - **[k8s/gatewayapi]** Document Gateway API generated service names change in the migration guide ([#13541](https://github.com/traefik/traefik/pull/13541) @rtribotte) - **[k8s/ingress-nginx]** Fix typo in nginx annotation proxy-buffer-numbers ([#13545](https://github.com/traefik/traefik/pull/13545) @fischerman) - Add a migration note for CONNECT requests ([#13554](https://github.com/traefik/traefik/pull/13554) @kevinpollet) ### v3.6.24 - Date: 2026-07-24 - Version: v3.6.24 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.6.24 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.6.24 - **security** — Fix vulnerability GHSA-3ccp-42pg-hgv6 - **fixed** — Add missing ErrorRequestHeaders field to CRDs - **fixed** — Remove unrelated error from nonexistent cert resolver log - **fixed** — Disable Zstd support in the gzhttp wrapper - **fixed** — Defer the CONNECT payload until the backend accepts the tunnel - **fixed** — Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy - **changed** — Bump google.golang.org/grpc to v1.82.1 - **fixed** — Do not add back CONNECT requests to the pool **Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.6/migrate/v3/#v3624). **CVE fixed:** - Advisory [GHSA-3ccp-42pg-hgv6](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6) **Bug fixes:** - **[middleware, k8s/crd]** Add missing ErrorRequestHeaders field to CRDs ([#13498](https://github.com/traefik/traefik/pull/13498) @kevinpollet) - **[logs]** Remove unrelated error from nonexistent cert resolver log ([#13469](https://github.com/traefik/traefik/pull/13469) @ArthurHlt) - **[middleware]** Disable Zstd support in the gzhttp wrapper ([#13533](https://github.com/traefik/traefik/pull/13533) @kevinpollet) - **[server]** Defer the CONNECT payload until the backend accepts the tunnel ([#13542](https://github.com/traefik/traefik/pull/13542) @sdelicata) - **[server]** Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ([#13543](https://github.com/traefik/traefik/pull/13543) @sdelicata) - **[server]** Bump google.golang.org/grpc to v1.82.1 ([#13551](https://github.com/traefik/traefik/pull/13551) @piscue) - **[server]** Do not add back CONNECT requests to the pool ([#13556](https://github.com/traefik/traefik/pull/13556) @kevinpollet) **Documentation:** - **[k8s]** Align certificateRef and indicate ports ([#13473](https://github.com/traefik/traefik/pull/13473) @veenoise) - **[rules]** Fix syntax notes in routing rule documentation ([#13501](https://github.com/traefik/traefik/pull/13501) @stevenlele) - Add a migration note for CONNECT requests ([#13554](https://github.com/traefik/traefik/pull/13554) @kevinpollet) ### v2.11.53 - Date: 2026-07-24 - Version: v2.11.53 - Original notes: https://github.com/traefik/traefik/releases/tag/v2.11.53 - Permalink: https://whatsnew.fyi/product/traefik/releases/v2.11.53 - **security** — Fix CVE-2024-45409 in advisory GHSA-3ccp-42pg-hgv6 - **fixed** — Add missing ErrorRequestHeaders field to CRDs - **fixed** — Defer the CONNECT payload until the backend accepts the tunnel - **changed** — Bump google.golang.org/grpc to v1.82.1 - **fixed** — Do not add back CONNECT requests to the pool **Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v2.11/migration/v2/#v21153). **CVE fixed:** - Advisory [GHSA-3ccp-42pg-hgv6](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6) **Bug fixes:** - **[middleware, k8s/crd]** Add missing ErrorRequestHeaders field to CRDs ([#13498](https://github.com/traefik/traefik/pull/13498) @kevinpollet) - **[server]** Defer the CONNECT payload until the backend accepts the tunnel ([#13542](https://github.com/traefik/traefik/pull/13542) @sdelicata) - **[server]** Bump google.golang.org/grpc to v1.82.1 ([#13551](https://github.com/traefik/traefik/pull/13551) @piscue) - **[server]** Do not add back CONNECT requests to the pool ([#13556](https://github.com/traefik/traefik/pull/13556) @kevinpollet) **Documentation:** - Add a migration note for CONNECT requests ([#13554](https://github.com/traefik/traefik/pull/13554) @kevinpollet) ### v3.7.8 - Date: 2026-07-15 - Version: v3.7.8 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.7.8 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.7.8 - **security** — Fix vulnerability GHSA-8rxv-jg7p-wvg3 - **fixed** — Add missing ErrorRequestHeaders field to CRDs - **fixed** — Sanitize rewritten target on ingress-nginx provider - **fixed** — Remove unrelated error from nonexistent cert resolver log - **fixed** — Fix panic in retry middleware with Websockets **CVE fixed:** - Advisory [GHSA-8rxv-jg7p-wvg3](https://github.com/traefik/traefik/security/advisories/GHSA-8rxv-jg7p-wvg3) **Bug fixes:** - **[middleware, k8s/crd]** Add missing ErrorRequestHeaders field to CRDs ([#13498](https://github.com/traefik/traefik/pull/13498) @kevinpollet) - **[k8s/ingress-nginx]** Sanitize rewritten target on ingress-nginx provider ([#13506](https://github.com/traefik/traefik/pull/13506) @gndz07) - **[logs]** Remove unrelated error from nonexistent cert resolver log ([#13469](https://github.com/traefik/traefik/pull/13469) @ArthurHlt) - **[middleware]** Fix panic in retry middleware with Websockets ([#13520](https://github.com/traefik/traefik/pull/13520) @juliens) **Documentation:** - **[k8s]** Align certificateRef and indicate ports ([#13473](https://github.com/traefik/traefik/pull/13473) @veenoise) - **[rules]** Fix syntax notes in routing rule documentation ([#13501](https://github.com/traefik/traefik/pull/13501) @stevenlele) - **[k8s/crd]** Fix duplicated options table in ServersTransport CRD reference ([#13518](https://github.com/traefik/traefik/pull/13518) @rachana5) ### v3.7.7 - Date: 2026-07-08 - Version: v3.7.7 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.7.7 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.7.7 - **security** — Fix CVE GHSA-cxjq-mrr5-89rv - **security** — Fix CVE GHSA-42cj-m3vj-89wv - **security** — Fix CVE GHSA-qq9q-x9w4-chhj - **fixed** — Add app-root middleware with nginx variable interpolation - **fixed** — Fix consistency between HostSNI(*) and Host(*) - **fixed** — Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace - **fixed** — Fix handle empty unknown-length bodies in mirroring - **fixed** — Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider - **fixed** — Sanitize replaced path in ReplacePathRegex middleware - **changed** — Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 - **changed** — Bump go.opentelemetry.io/otel to v1.44.0 - **fixed** — Fix panic when endpointslice port value or name is nil **Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.7/migrate/v3/#v377). **CVE fixed:** - Advisory [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv) - Advisory [GHSA-42cj-m3vj-89wv](https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv) - Advisory [GHSA-qq9q-x9w4-chhj](https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj) **Bug fixes:** - **[middleware, k8s/ingress-nginx]** Add app-root middleware with nginx variable interpolation ([#13398](https://github.com/traefik/traefik/pull/13398) @dfeinblatt) - **[rules]** Fix consistency between HostSNI(*) and Host(*) ([#13460](https://github.com/traefik/traefik/pull/13460) @juliens) - **[k8s, k8s/gatewayapi]** Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace ([#13462](https://github.com/traefik/traefik/pull/13462) @gndz07) - **[middleware]** Fix handle empty unknown-length bodies in mirroring ([#13399](https://github.com/traefik/traefik/pull/13399) @amazon7737) - **[k8s/crd]** Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ([#13458](https://github.com/traefik/traefik/pull/13458) @gndz07) - **[middleware]** Sanitize replaced path in ReplacePathRegex middleware ([#13466](https://github.com/traefik/traefik/pull/13466) @kevinpollet) - **[acme]** Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ([#13477](https://github.com/traefik/traefik/pull/13477) @rtribotte) - **[otel]** Bump go.opentelemetry.io/otel to v1.44.0 ([#13478](https://github.com/traefik/traefik/pull/13478) @rtribotte) - **[k8s]** Fix panic when endpointslice port value or name is nil ([#13481](https://github.com/traefik/traefik/pull/13481) @kevinpollet) **Documentation:** - Fix version in migration guide ([#13434](https://github.com/traefik/traefik/pull/13434) @kevinpollet) - Fix changelog v2.11.51 ([#13430](https://github.com/traefik/traefik/pull/13430) @mmatur) - Add v3.7 to supported version docs ([#13118](https://github.com/traefik/traefik/pull/13118) @jnoordsij) - Fix some function names in comments ([#13443](https://github.com/traefik/traefik/pull/13443) @blackflytech) - Add @nandorKollar as a current maintainer ([#13451](https://github.com/traefik/traefik/pull/13451) @emilevauge) - Add @amazon7737 as a current maintainer ([#13450](https://github.com/traefik/traefik/pull/13450) @emilevauge) - **[middleware]** Clarify buffering middleware defaults ([#13401](https://github.com/traefik/traefik/pull/13401) @amazon7737) - Fix grammar in TLS, TCP service, and routing reference docs ([#13461](https://github.com/traefik/traefik/pull/13461) @almightymoon) - Fix X-Forwarded-Prefix documentation for dashboard redirection ([#13472](https://github.com/traefik/traefik/pull/13472) @kevinpollet) ### v3.6.23 - Date: 2026-07-08 - Version: v3.6.23 - Original notes: https://github.com/traefik/traefik/releases/tag/v3.6.23 - Permalink: https://whatsnew.fyi/product/traefik/releases/v3.6.23 - **security** — Fix CVE GHSA-cxjq-mrr5-89rv - **security** — Fix CVE GHSA-42cj-m3vj-89wv - **fixed** — Fix panic when endpointslice port value or name is nil in Kubernetes provider - **fixed** — Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider - **fixed** — Fix handle empty unknown-length bodies in mirroring middleware - **fixed** — Sanitize replaced path in ReplacePathRegex middleware **CVE fixed:** - Advisory [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv) - Advisory [GHSA-42cj-m3vj-89wv](https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv) **Bug fixes:** - **[acme]** Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ([#13477](https://github.com/traefik/traefik/pull/13477) @rtribotte) - **[k8s]** Fix panic when endpointslice port value or name is nil ([#13481](https://github.com/traefik/traefik/pull/13481) @kevinpollet) - **[k8s/crd]** Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ([#13458](https://github.com/traefik/traefik/pull/13458) @gndz07) - **[middleware]** Fix handle empty unknown-length bodies in mirroring ([#13399](https://github.com/traefik/traefik/pull/13399) @amazon7737) - **[middleware]** Sanitize replaced path in ReplacePathRegex middleware ([#13466](https://github.com/traefik/traefik/pull/13466) @kevinpollet) - **[otel]** Bump go.opentelemetry.io/otel to v1.44.0 ([#13478](https://github.com/traefik/traefik/pull/13478) @rtribotte) **Documentation:** - **[middleware]** Clarify buffering middleware defaults ([#13401](https://github.com/traefik/traefik/pull/13401) @amazon7737) - Add @amazon7737 as a current maintainer ([#13450](https://github.com/traefik/traefik/pull/13450) @emilevauge) - Add @nandorKollar as a current maintainer ([#13451](https://github.com/traefik/traefik/pull/13451) @emilevauge) - Fix changelog v2.11.51 ([#13430](https://github.com/traefik/traefik/pull/13430) @mmatur) - Fix grammar in TLS, TCP service, and routing reference docs ([#13461](https://github.com/traefik/traefik/pull/13461) @almightymoon) - Fix some function names in comments ([#13443](https://github.com/traefik/traefik/pull/13443) @blackflytech) - Fix version in migration guide ([#13434](https://github.com/traefik/traefik/pull/13434) @kevinpollet) - Fix X-Forwarded-Prefix documentation for dashboard redirection ([#13472](https://github.com/traefik/traefik/pull/13472) @kevinpollet) ### v2.11.52 - Date: 2026-07-08 - Version: v2.11.52 - Original notes: https://github.com/traefik/traefik/releases/tag/v2.11.52 - Permalink: https://whatsnew.fyi/product/traefik/releases/v2.11.52 - **security** — Fixed advisory GHSA-cxjq-mrr5-89rv - **fixed** — Sanitize replaced path in ReplacePathRegex middleware - **changed** — Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 - **changed** — Bump go.opentelemetry.io/otel to v1.44.0 **CVE fixed:** - Advisory [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv) **Bug fixes:** - **[middleware]** Sanitize replaced path in ReplacePathRegex middleware ([#13466](https://github.com/traefik/traefik/pull/13466) @kevinpollet) - **[acme]** Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ([#13477](https://github.com/traefik/traefik/pull/13477) @rtribotte) - **[otel]** Bump go.opentelemetry.io/otel to v1.44.0 ([#13478](https://github.com/traefik/traefik/pull/13478) @rtribotte) **Documentation:** - Fix changelog v2.11.51 ([#13430](https://github.com/traefik/traefik/pull/13430) @mmatur)