Traefik has released v3.7.12, a patch version that focuses on stability and security. This release addresses several bugs across HTTP/3, Kubernetes providers, and core server functionality. Notably, it also introduces a new entry point option for handling aliased request headers, which may require configuration review. The migration guide is recommended, especially if you use the affected features.
Here are the key changes:
- HTTP/3 timeouts: Applied read timeout, idle timeout, and max header bytes for HTTP/3 connections, aligning behavior with HTTP/2 and HTTP/1.1. This improves security and resource management.
- FastHTTP update: Bumped
github.com/valyala/fasthttpto v1.73.0 in thefastproxypackage, bringing performance and security fixes. - File provider errors: The file provider now includes the filename in configuration errors, making debugging easier.
- Kubernetes fixes: Fixed a redirect issue for www host with a non-numeric port in the
k8sandk8s/ingress-nginxproviders. Also fixed a TLS option name collision across namespaces in theingress-nginxprovider, which could cause incorrect TLS configurations. - Server entry point option: Added an entry point option to handle request headers with aliasing names. This allows you to configure how duplicate or aliased headers are processed, e.g.,
X-Forwarded-ForandX-Forwarded-Host. This is behind a new option and requires explicit configuration. - TCP/UDP services: Rejected negative weights in TCP and UDP weighted services, preventing invalid configurations that could cause undefined behavior.
- Dependency bumps: Bumped
etcdclient modules to v3.5.33. - Documentation enhancements: Updated security threat model documentation, fixed formatting in the Kubernetes setup guide, and clarified
ServersTransportbehavior for the errors middleware, among other doc fixes.
For developers, this release is important because it patches several edge cases that could lead to misconfigurations or security issues in Kubernetes environments, especially with ingress-nginx and TLS. The new entry point option for aliased headers gives you more control over header normalization, which is useful in reverse proxy setups. The HTTP/3 timeout handling also ensures that this protocol is no longer a gap in resource limits.
Be sure to review the migration guide and update your configuration to leverage the new header aliasing option if needed. For the full list of changes, see the release page.
Source: https://github.com/traefik/traefik/releases/tag/v3.7.12