Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Traefik / v3.7.15

Traefik v3.7.15

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-10-16T08:01:08Z · GitHub release

Summary of changes

Important: Please read the migration guide. CVE fixed: - Advisory GHSA-p8wx-ph99-xgcr - Advisory GHSA-ww7c-q3mv-xx22 - Advisory GHSA-28hp-c82p-8vqj Bug fixes: - [server] Reject CONNECT requests regardless of HTTP version (#14031 @juliens) - [server] Reject CONNECT method before reaching the muxer (#14050 @juliens) - [k8s/crd] Allow observability metadata on child routers (#14018 @bunnysayzz) - [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 (#14017 @rtribotte) - [k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol (#13935 @Tyagiquamar) - [k8s/ingress-nginx] Apply auth-tls client authentication to the whole host (#14057 @juliens) - [k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options (#14066 @juliens) - [fastproxy] Add a non-regression test for CR/LF in FastProxy request headers (#13642 @mturac) …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.