The Traefik team has released v3.6.24, a patch version that fixes multiple issues around CONNECT proxy requests, middleware behavior, and Kubernetes CRD alignment. This release also updates the gRPC dependency and clarifies routing documentation.
Key changes include:
- CONNECT request handling (#13542, #13543, #13556): The payload is now deferred until the backend accepts the tunnel (
server), the body is discarded inforwardauthand rejected with fast proxy, and CONNECT requests are no longer added back to the connection pool. This resolves potential resource leaks and incorrect behavior. - Middleware fixes: Added the missing
ErrorRequestHeadersfield to CRDs (#13498) – important for Kubernetes users relying on error middleware headers. Also disabled Zstd support in thegzhttpwrapper (#13533) to avoid compatibility issues with certain backends. - Log improvements: Removed an unrelated error log about nonexistent certificate resolver (#13469), reducing noise in logs.
- Dependency bump: Upgraded
google.golang.org/grpcto v1.82.1 (#13551) to include security and performance patches. - Documentation: Certificate references in Kubernetes are now aligned, ports are indicated (#13473), routing rule syntax notes fixed (#13501), and a migration note for CONNECT requests added (#13554).
For developers using Traefik as a reverse proxy, especially with CONNECT tunnels (e.g., for HTTPS inspection or WebSocket upgrades), this release closes critical gaps in request lifecycle management. The CRD fix also ensures that k8s CRD users can correctly configure error middleware headers, while the log cleanup reduces alert fatigue. Upgrading is recommended if you rely on CONNECT proxying or any of the affected middleware features.
Source: https://github.com/traefik/traefik/releases/tag/v3.6.24