Traefik has published v2.11.59, a maintenance release on the 2.11 branch that focuses entirely on bug fixes rather than new features. The headline change is a hardening of the HTTP server: the project now rejects CONNECT requests regardless of the HTTP version and does so before the request reaches the muxer. A dependency bump rounds out the release, and the maintainers explicitly point readers to the migration guide before upgrading.
- Reject CONNECT requests regardless of HTTP version (
#14031), closing a gap where behaviour could differ between HTTP/1.x and HTTP/2 connections. - Reject the CONNECT method before reaching the muxer (
#14050), so the request is refused at the server layer instead of being routed through normal handler logic. - Bump
golang.org/x/nettov0.60.0(#14048), pulling in the latest upstream networking fixes.
The CONNECT method is normally used to establish a tunnel through a proxy. In a reverse proxy like Traefik, letting such requests flow into the routing stack can expose code paths that were never meant to handle tunnelling semantics. By rejecting CONNECT at the earliest possible point — and doing it consistently for every HTTP version — the fix shrinks the attack surface instead of relying on downstream handlers to refuse the method.
The practical impact for developers is small but worth noting. If you run Traefik as an ingress or edge proxy, upgrading to v2.11.59 removes an unnecessary request path with no configuration changes required, making it a low-risk patch to adopt. Teams that deliberately relied on tunnelling behaviour through Traefik should verify their setup, since such requests are now refused up front. As always with this branch, check the migration guide first and confirm your deployment still behaves as expected after the bump to golang.org/x/[email protected].
Source: https://github.com/traefik/traefik/releases/tag/v2.11.59