Traefik + CloudFlare

This release addresses a security vulnerability, fixes several bugs including a retry middleware panic, and updates Kubernetes and routing documentation.

This release fixes several security vulnerabilities (CVEs), addresses various bugs across middleware and Kubernetes providers, and updates documentation.

This release addresses security vulnerabilities (CVEs), fixes several bugs across Kubernetes, middleware, and ACME components, and includes various documentation updates.

This release addresses a security vulnerability, fixes a path sanitization bug in ReplacePathRegex middleware, and updates several dependencies.

This release addresses several CVEs, fixes numerous bugs across Kubernetes providers and middlewares, and includes various documentation updates.

This release fixes two CVE security vulnerabilities, resolves multiple bugs across Kubernetes, middleware, and TLS, and includes several documentation updates.

This release fixes two CVE security vulnerabilities, addresses several bugs in ACME and authentication middleware, and adds configurable max request header size.

Bug fixes: skip ingress on failed auth-secret, endpointslice fencing for ingress-nginx, reject cross-provider references in gatewayapi, server go-proxyproto v0.12.0, and TLS fixes for routers with same host but different TLS options and SNICheck for hosts-less routers.

Bug fixes: reject cross-provider backendRefs.namespace in k8s gatewayapi, upgrade go-proxyproto v0.12.0, fix TLS for routers with same host across different tlsoptions on different entryPoints, and fix snicheck for routers with no hosts.

Bug fixes: TLS - fixed routers with the same host but different tlsoptions across entryPoints; TLS - fixed snicheck for routers that have no hosts.

Bug fixes across middleware config, web UI (React Router, axios), k8s gatewayapi BackendTLSPolicy status, http3 quic-go bump, and TLS keepalive snicheck.

Bug fixes: resolve redis write-timeout option in middleware; update web UI dependencies (react-router, jsdom, axios); fix BackendTLSPolicy status in k8s/gatewayapi; upgrade http3 quic-go to v0.59.1; fix TLS snicheck with keepalive.

Bug fixes: quic-go updated to v0.59.1 for http3, webui updated with axios v1.17.0, and TLS snicheck fixed with keepalive.

This release fixes TLS option resolution, UI/dashboard service flow, Kubernetes/ingress-gatewayapi quirks, access logs, file/provider behavior, server/middleware fixes, plus documentation polish and maintainer updates.

Fixes include TLS option resolution, log escaping, gRPC method matching, allowing dropped query params in RequestPath, dependency bumps, and security fixes for ingress and auth, plus minor docs and maintainer updates.

Bug fixes across TLS, auth, k8s ingress, server, and middleware: fixed tlsOptions resolution, error on empty basic auth users, avoided ingress path injection, moved snicheck to ctx, rejected path mismatches after StripPrefix normalization, plus deps bumps.

Security: fixed CVE-2026-44774; Bug fixes: added CrossProviderNamespaces option for k8s components (ingress, crd, gatewayapi) and corrected cross-provider ref checks for the Kubernetes CRD provider.

Security: fixes CVE-2026-44774; Kubernetes: add CrossProviderNamespaces option and fix cross-provider ref check for the CRD provider; see migration guide.

CVE-2026-44774 fix released; Kubernetes: add CrossProviderNamespaces option across k8s/ingress, k8s/crd, k8s/gatewayapi, and tighten cross-provider ref checks for the Kubernetes CRD provider.

Adds dynamic metamodel config for ingress-nginx, limit-annotations, provider routing precedence, gatewayapi/k8s improvements, Web UI and TLS enhancements, new observability/logging features, and numerous bug fixes and documentation updates.

Bug fixes: remove cross-provider k8s service sanitization; fix default CORS headers in k8s/ingress-nginx; bump OpenTelemetry; and migrate docker/ecs to moby/moby modules. See migration guide.

Bug fixes: Kubernetes CRD no longer sanitizes cross-provider Kubernetes service loading; Docker and ECS now migrate to github.com/moby/moby modules.

Bug fixes: upgrade ACME Lego to v4.35.2/v4.35.1, add Errors middleware errorRequestHeaders option, allow ExternalName services to omit port in Kubernetes, bump oxy to v2.1.0; misc: make FLAGS variable usable.

Adds errorRequestHeaders option to Errors middleware; bumps Lego to v4.35.2 for ACME; and makes FLAGS Make variable usable.

Bug fixes across middleware authentication, forward auth, logging, header sanitization, and Kubernetes CRD: remove empty notFoundSecret, fix trustForwardHeader, normalize logs, drop untrusted underscores, sanitize URLs, and honor cross-namespace with chain middleware.

Bug fix: upgrade compression middleware and fix TestNegotiation; documentation updates for docker setup, service discovery scope, Kubernetes ingress-nginx IP management, IngressClass logic, redirects, and http.sanitizePath default.

This release fixes numerous bugs across ingress-nginx, API validation, TLS/STARTTLS, and middleware, bumps dependencies (lego v4.33.0, grpc v1.79.3), and updates ACME and Kubernetes documentation.

Bumps grpc to v1.79.3, fixes duplicate user headers in basic/digest auth middleware, and corrects StripPrefix/StripPrefixRegex to slice prefixes by encoded length.

Bug fixes: OTEL trace attributes for logs; fix k8s listener/route hostname match and ingress rule; nginx ingress proxy-ssl-verify; HTTP maxResponseBodySize; TLS fragmented client hello; constant-time basic auth.

Bug fixes: add maxResponseBodySize for HTTP, support fragmented TLS client hello, and make basic auth timing constant; Documentation: bump mkdocs-traefiklabs to consent mode.

Bug fixes across Docker/OpenTelemetry, fasthttp, healthcheck, k8s gateway, middleware, otel, server, and webui, plus docs corrections for Digest auth, TOML tables, entrypoints, and API basepath.

Bug fixes: Docker and OpenTelemetry dependencies bumped; server golang.org/x/net upgraded to v0.51.0.

Bug fixes: lego v4.32.0; fix x-forwarded header case, handle empty/missing User-Agent, add forwardAuth maxResponseBodySize, and TLS handshake error handling. Documentation: Docker guide, Kubernetes labelSelector casing, nginx-annotation note, wider content, and encoded chars in entrypoints.

Bug fixes: fix case-insensitive handling of x-forwarded Connection headers, add maxResponseBodySize to forwardAuth, and improve TLS handshake error handling.

Addresses CVE-2026-25949 and includes numerous bug fixes across ACME, healthcheck, TLS, server, tracing, web UI, and observability, plus documentation updates and merges from v2.11 into v3.6.

Bug fixes: validate healthcheck path configuration and cap TLS record length to RFC 8446 limit during ClientHello peeking.

Preventing service recursion, bumping web UI dependencies, and fixing the migration guide by removing extra dots.

This hotfix is opt-in and breaking compared to v3.6.4, reverts default behavior, fixes CVE-2026-22045, and includes numerous bug fixes across acme, k8s, webui, server, and documentation.

This hotfix introduces opt-in encoded-character behavior (breaking since v2.11.32), includes the CVE-2026-22045 fix, and adds ACME-TLS/1 handshake timeout with migration guidance.

Bug fixes: Lego v4.30.1, quic-go v0.58

Bug fix: server now correctly handles encoded characters that were being denied (fix for #12457).

Server now logs access for rejected requests and warns about the new behavior; documentation updated to clarify and fix encoded character rejection, entryPoint, and option details.

Bug fixes for k8s ingress-nginx sslredirect support and server-rejected access logs; docs update: add auth-signin to unsupported annotations, note a breaking change, and fix encodedCharacters entryPoint documentation.

Fixes for CVEs 2025-66490/66491 (breaking change with migration guide); numerous bug fixes across server, plugins, HTTP/3, k8s/ingress-nginx, middleware; plus documentation updates and repo merge commits.

Fixes for CVE-2025-66490 with breaking change and migration guide; additional bug fixes (suspicious encoded chars, plugin name validation, http3/quic-go bumps, crypto) and documentation updates to SECURITY.md.

Bug fix: Deprecate the Kubernetes Ingress NGINX provider experimental flag, aligning with the migration guide.

Release includes bug fixes: auto-negotiate Docker API version, multi-layer server routing, UDP pool revert, Safari navigation fix, and remote upgrade button; plus Kubernetes docs updates for Nginx provider and Gateway API version/features.

Bug fix: Docker and Docker Swarm now auto-negotiate the Docker API version for improved compatibility.

Traefik 3.6 adds ACME certificates resolvers options, expanded provider namespace visibility, Docker non-running container discovery, ECS IPv6 support, additional load balancing modes, health checks, Knative, Gateway API upgrade, ExternalName publishing, middleware/server improvements, plugins, and UI tweaks.

Bug fixes include updating lego to v4.28.0 and filtering unknown nodes in the deprecation loader; docs add missing ACME options, fix default encodings in compress middleware, and refresh the Configuration Overview page.

Multi-component release fixing ACME, HTTP/3, KV, logs/OTel, TLS; adds stdout logging with OTLP, TLS staple updates, UI version fix, and numerous docs fixes, plus branch merges.

Bug fixes: dependency bumps (quic-go v0.55.0, golang.org/x/net v0.46.0, dd-trace-go.v1 v1.74.6) and a fix to the KV alive-check key name.

Bug fixes include k8s CRD MaxIdleConnsPerHost, plugin system refactor, proxy header construction via client conn, and web UI script update; docs fix links, new CR

Bug fixes include OTEL log body, ACME library update, gatewayapi app protocol case-insensitive, docs typo fix, proxyproto bump, silent on SIGTERM, tracing header canonicalization and root span naming; UI deps updated and code refactor using reflect.TypeFor.

Bug fixes: update lego to v4.25.2 and docker to v28.3.3; Documentation fixes for invalid links and v3.5 release docs.

Adds ACME OCSP stapling, ACME http challenge delay and provider timeout controls, healthcheck URL/interval options, Kubernetes gateway-api v1.3.0, Ingress prefix consistency, NGINX Ingress provider, unsafe yaegi in plugins, Post-Quantum TLS, React UI migration, and related fixes.

Bug fix: http3 now uses quic-go v0.54.0; Documentation typo corrected; Misc: merged v2.11 into v3.4 (two merges).

Bug fixes: redact install config in logs, fix archive extraction zip-slip in plugins, and disable MPTCP by default; Documentation: remove all mentions of TLSOption CurvePreferences ordering.

Bug fixes for k8s gateway annotation respect and WRR/P2C balancer map concurrency; documentation updates: new Docker/K8s expose/setup guides, swarm label fix, OTLP docs, Traefik Platform page; and branch merge v2.11 into v3.4.

Bug fix: Update github.com/go-viper/mapstructure/v2 to v2.3.0 (PR #11880 by kevinpollet).

Adds ACME improvements (OCSP stapling, delay, HTTP timeout), healthcheck options, Kubernetes Gateway API bump, Ingress prefix fix, NGINX Ingress provider, ForwardAuth context cancel, unsafe in yaegi plugin manifest, post-quantum TLS, React web UI, and assorted master merges.

Bug fix: update http3 by bumping quic-go to v0.49.0 (PR #11848).

Documentation updates across certificates, Docker/Kubernetes tutorials, Ingress Backend support notes, observability guides, circuit breaker clarification, mirroring default percent, websocket guide; and merging v2.11 into v3.4.

Fix: middleware stops logging Redis Sentinel credentials; docs: correct KV reference rendering, fix redirect middleware typo, and update supported versions.

This release fixes CVE-2025-47952, patches several bugs across docker, k8s/crd, middleware, server, service, and webui, updates documentation, and merges v2.11 branches into v3.4.

Fixes CVE-2025-47952; bug fixes for k8s ingress panic and server path normalization; docs updated with multi-tenant TLS guidance, note on disabling connection reuse, broken link fix, and path sanitization migration guide version change.

Traefik 3.4 adds ACME profile/emailAddresses, label-based server URLs, K8s CRD/Gateway/API enhancements, status for Ingress, request-method preservation, error-page status rewrite, Redis rate limiter, p2c LB, sticky cookies, TLS/rootCA config via configmaps, UDP, and a

Bug fix: accessLogs now include SpanID and TraceID fields for logs, middleware, and accesslogs only when tracing is enabled.

Fixes three CVEs (2025-32431, 2025-22868, 2025-22871); sanitizes incoming request paths (collapsing /../, /./ and duplicate slashes) since v3.3.6; plus documentation updates and merges from v2.11 into v3.3.

Fixes: three CVEs; request path sanitization since v2.11.24 (removing ../, ./, double slashes) with migration guide; bug fixes across acme, metrics, middleware, server, Redis, Go deps; documentation updates.

This release fixes k8s GatewayAPI HTTPS scheme, restores v2 compress priority, fixes abort on malformed content-type and flush-compression, updates docs for forwarded headers and routing reference, and merges v2.11 into v3.3.

Release fixes: dependency bumps (AWS SDK v2, oxy, net, jwt, redis, jose), TLS config error logging, HostSNI underscore support, UI boolean defaults, docs updates on access logs, retry middleware TCP usage, Redis dynamic config tip, and new Security Support.

Release includes fastproxy fixes (WebSocket headers, chunked responses, fasthttp v1.58.0), metrics unit changed to seconds, tracing improvements using ResourceAttributes, sticky-cookie hash fix, ACME/docs updates, and a branch merge from v2.11 into v3.3.

Bug fixes: update lego to v4.22.2, paerser to v0.2.2; enable retry middleware in the proxy and ensure retries send headers on Write.

Bug fixes: avoid creating default observability model; fix content-length header checks and handle missing length; add missing headerField in Middleware CRD; restore TraceID/SpanID in access logs. Misc: merge v2.11 into v3.3 branches.

Fix: graceful shutdown for ACME JSON write; Docs: replace docker-compose with docker compose.

Bug fixes: adjust missing client cert log level to debug, avoid per-proxy logger creation, and fix WebUI auto-refresh not clearing on unmount; Documentation: remove awesome.traefik.io reference.

Bug fixes: avoid reading body for HEAD requests, fix observability config on EntryPoints, and set webui content-type; Documentation: fix acme propagation logging and add trailing s to propagation.delayBeforeCheck; Misc: merge v2.11 into v3.3.

Bug fix: Disable HTTP/2 connect setting by default for WebSocket connections on the server.

Bug fix: WebSocket/server now disables the HTTP/2 connect setting by default for WebSocket support.

Bug fix: Disable the HTTP/2 connect setting for WebSocket by default (affecting websocket and server).

Enhancements include ACME propagation controls, API dump endpoint, OTLP logs, per-entrypoint observability, sticky-session path, configurable UI base path, and optional IngressRoute kind; bug fix for fenced server status.

Fix websocket upgrade issue with GODEBUG; bug fixes for k8s/gatewayapi empty API group, IngressRouteTCP TLS bool passthrough, SPIFFE v2.4.0, and duplicate dependency removal; docs update to gatewayapi v1.2.1 and new maintainer; branch merges.

Addresses the websocket upgrade issue with a workaround; fixes include ACME lego upgrade, basicauth typo, ReverseProxy ErrorLog config, x/net bump to v0.33.0, plus docs tweaks for allowACMEByPass and 2025 copyright.

Documentation: update the reference install documentation to reflect the current chart default; Misc: merge of v2.11 into v3.2 (two separate merges).

Bug fix: server updates to golang.org/x dependencies to address issues (PR #11336).

Addresses CVE-2024-53259; fixes include Docker Swarm label rename, Gateway API bumped to v1.2.1, WASM settings for plugins, default rule syntax model fixes, plus documentation updates.

Patched CVE-2024-53259; bug fixes include updating go-acme/lego to v4.20.4 and quic-go to v0.48.2 for the acme and http3 components.

CVE-2024-45410 advisory addressed; fixes include Kubernetes HostRegexp rule syntax v2, DEBUG logging for Postgres first-byte errors, websocket upgrade case; docs updated for cert-manager certificates, swarm Docker tips, and Compress in migration; branches v2.11 merged into

Remediates CVE-2024-45410 with a migration guide; fixes include ACME lego v4.20.2, DEBUG-level first-byte logs, dropping untrusted X-Forwarded-Prefix, keepalive for h2c, ServiceBuilder fixes, and accompanying docs updates.

Traefik v3.2 adds ACME improvements (no email requirement, custom CA certs, 30-day certs), Docker BasicAuth, expanded GatewayAPI/k8s features, OTLP service.name, new middleware options, performance/server boosts, plus fixes and docs.

Bug fix: preserve HTTPRoute filters order; Documentation: fix broken Kubernetes Gateway provider links; Misc: merge v2.11 into v3.1 (two merges).

Fixes panic on aborted requests in middleware/service to ensure connections close properly; updates to business callouts in the documentation.

Bug fixes: reuse compression writers, fix Accept-Encoding default weight in middleware, and close wasm middleware to prevent memory leaks; Misc: merged v2.11 into v3.1 (two PRs).

Bug fixes include middleware compress bump, WebUI Node 22.9 upgrade with yarn lock, and improved WebUI port-number layout; docs clarify that only header fields may be redacted in accesslogs and update the business callout.

Bug fixes: disable IngressClass lookup when disableClusterScopeResources is enabled and adjust server timeout logging to avoid logs on timeout; Misc: merged v2.11 into v3.1 branches.

Bug fixes: fixes for default cert CN, forward-auth headers, compress dependency bump, non-logging on timeout, and removing unused webui boot files; Documentation: default access log format and API pagination updates.

Fix: guess Datadog socket type for unix prefixes; Docs: update README to mention v3; Misc: merge v2.11 into v3.1.

Bug fixes: update quic-go to v0.47.0 for http3 and fix nil-check for ACME certificate resolver in server.

Fixes Kubernetes Ingress syntax/config, middleware metrics capture, and plugin initialization; docs updated (APIVersion removal, requirements, tracing); merges from v2.11 into v3.1; and remediation for CVE-2024-45410.

Security update addressing CVE-2024-45410; bug fixes across ACME (lego v4.18.0, custom router challenges), logs/middleware (case-insensitive keys, aborted streaming logs), headers cleanup, TCP WRR error logging, plugins/webui upgrades, plus docs improvements.

Bug fixes: include Gateway status addresses, disable Kubernetes scope resources discovery, emit logs to stdout, and Grafana scrape interval support. Docs: add access logs migration, fix HTTP docs, and Gateway API channel default. Misc: merge v2.11 into v3.1.

Bug fixes: update docker to v27.1.1 and upgrade webui dependencies; Documentation: fix embedded YouTube video and update index.md to include video.

Bug fixes: bump gRPC to v1.64.1, skip route status updates when unchanged, fix metrics for long scrape intervals, add open connections gauge and ServiceName metric, plus documentation cleanup removing a duplicated kubectl apply in Kubernetes Gateway docs.

Bug fixes: more accurate version log; enforce default TLS cipher suites. Documentation: clarified certificatesDuration, API exposure, sensitive-label data, router-service linkage, Docker port selection, v3.1 versions table, and PR approval process.

Traefik 3.1 expands Kubernetes Gateway API support (v1.1.0, non-experimental), adds HTTPRoute matching/rewrites and status handling, ReferenceGrant and priority computations, plus broader middleware/plugins improvements and OpenTelemetry updates.

Addresses CVE-2024-39321; documentation links fixed and maintainers updated; plus three merges of v2.11 into v3.0.

Addresses CVE-2024-39321 with fixes: ECS OIDC/IRSA config, disable QUIC 0-RTT, remove IPv6 interface names; plus docs updates including ACME docker-compose typo, capability/readme maintainer updates, and readme tweaks.

Adds extensive k8s GatewayAPI upgrades (v1.1, status handling, route attachments, redirects, priorities, HTTPRoute matching) plus healthcheck, telemetry, plugins enhancements and systemd socket activation.

Fixes CVE-2024-35255 (GHSA-rvj4-q8q5-8grf) and merges v2.11 into v3.0, consolidating changes into the 3.0 release.

Addresses CVE-2024-35255 security advisory; fixes acme by updating go-acme/lego to v4.17.4; updates the supported versions documentation.

Addresses CVE-2024-24790; fixes logs (OTel deps, log append), metrics label, middleware status with Brotli, Accept-Encoding weights; updates v2→v3 migration guide; merges v2.11 into v3.0.

Addresses CVE-2024-24790; fixes acme with go-acme/lego v4.17.3; updates domain examples; clarifies Ratelimit header behavior; adds getting-started guide; removes deprecated Helm repo warning.

CVE-2024-24788 addressed; numerous bug fixes across k8s ingress, metrics/tracing, TLS/TSCert, TCP rules, PostgreSQL, and WebUI IP allowlist, plus documentation corrections and an http3 migration note.

Fixed CVE-2024-24788; bug fixes include removing deadlines for non-TLS, Web UI CSP display fix and provider icon sizing; documentation updates cover k8s CRD migration, gatewayapi HTTPRoute fixes, improved Kubernetes mirroring example, CLI capitalization consistency, and migration wording.

Release introduces extensive v3 enhancements across providers (Consul, Docker split, ECS healthy tasks, file reload on SIGHUP, HTTP/3 outside experimental), stronger Kubernetes GatewayAPI support, improved observability, plus numerous fixes and docs.

Migration guide provided; fixes address two CVEs (CVE-2023-45288, CVE-2024-28869) and server bugs: revert LingeringTimeout and set ReadTimeout default to 60s.

Extensive bug fixes across ACME/TLS, Docker/QUIC, ECS, logs, middleware, plugins, providers, rules, server/tcp, tracing, and web UI, plus updates to lego, Yaegi, quic-go, and documentation improvements.

Deprecates IPWhiteList in favor of IPAllowList; adds Redis Sentinel support, KeepAliveMaxTime/MaxRequests for entrypoints, and WRR sticky cookie hashing, plus numerous bug fixes and documentation updates.

Bug fix: resolved the Datadog logs JSON format issue, addressing the JSON formatting problem in logs.

Addresses three CVEs, fixes several bugs across acme, consul, http3, middleware, provider, server, and tracing; plus governance/docs updates.

This release fixes several issues (accesslogs origin capture, preflight status, KV key-not-found handling, forward-auth leak, CNAME logging, X-Forwarded-For deletion) and updates dependencies (lego, quic-go, x/net, grpc-go) plus documentation tweaks.

Bug fixes: update lego to v4.13.2 and v4.13.0, fix panic on k8s resource backends, and improve trace

Bug fix: updates ACME support by upgrading go-acme/lego to v4.12.2.

Release includes ACME lego updates up to v4.12.1, wildcard/domain check fixes; Kubernetes CRD bugfixes and Hub cleanup; metrics/provider tweaks; middleware and plugin error messaging improvements; tracing update and various docs updates.

Bug fixes: update vulcand/oxy to be5cf38 (middleware/oxy); Documentation: fix v2.10 migration guide.

Traefik v2.10 adds Kubernetes CRD/API Group, native service load-balancing, Docker ContainerName exposure, metrics/tracing improvements, Nomad multi-namespace support, web UI tweaks, plus fixes/docs—remember to update CRDs and RBAC before upgrading Kubernetes.

Release notes fix CVE-2023-29013, with related mitigation for CVE-2023-24534, addressing a security vulnerability and dependent components.

Bug fixes include updating lego to v4.10.2, quic-go to v0.33.0, metrics default cert, oxy, Nomad defaults and TLS, and removing the User-Agent header; documentation clarifications for rate limit middleware and TCP router variable naming.

Bug fix: server updates golang.org/x/net to v0.7.0 to address CVE-2022-41724.

Release fixes: upgrade lego, harden ECS, improve file config resilience, differentiate UDP/TCP logs, guard middleware rate limiting and header handling, update plugins, bump TLS/quic, add IPv6 in TCP HostSNI, plus various docs improvements.

Bug fix: create a new capture instance per incoming request; Documentation: update Helm repo, improve building-testing wording, add link descriptions, and remove the experimental tag on the Traefik Hub header.