Traefik v3.7.13 released on 04-09-2026
Traefik v3.7.13 is out now. Operators should read the migration guide for the v3.7.x line and apply the update promptly because the release contains multiple CVE fixes and several TLS, ACME and protocol hardenings.
See the migration guide and the full release notes on the Traefik documentation and GitHub for detailed upgrade steps and the security advisories addressed.
What’s in this release
- Five GitHub Security Advisories fixed: GHSA-qqjf-53cj-pwvv, GHSA-f52w-8j3h-j724, GHSA-v67p-phpq-fc8x, GHSA-w4v4-9rw7-5326 and GHSA-8fcf-v89g-xpg6.
- ACME and TLS updates: github.com/go-acme/lego/v5 bumped to v5.4.1; DNS-01 challenge behaviour changed to disable recursive nameserver propagation by default; negated matchers ignored when parsing rule domains; duplicate TLS certificates are redacted in provider merge logs; quic-go bumped to v0.62.0.
- Server, HTTP/3 and request-handling hardening: a transport is dedicated per HTTP/3 client connection; requests with opaque request targets are denied; h2c upgrade headers and request trailer values are not forwarded to backends; configuration copies are built only once per change to reduce CPU work.
Upgrade notes
- Read the migration guide before upgrading: https://doc.traefik.io/traefik/v3.7/migrate/v3/#v3713 and review the linked GitHub security advisories.
- The release notes do not include specific rollback instructions; keep configuration backups and deployment snapshots when performing the upgrade.
Share upgrade experiences, issues or regressions on the Traefik GitHub repository or community channels so others can benefit from your findings.
