Infrastructure
Traefik: supported versions and open vulnerabilities today
Traefik 3.7 is supported; 3.6 reached end of life on Aug 16, 2026; the latest release is 3.7.15. 22 high or critical advisories for Traefik were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 3.7.15
- GitHub stars
- 65.2k
- Licence
- MIT
- OpenSSF Scorecard
- 6.4 / 10
Supported versions
Security advisories
43 advisories published in the last 12 months, 22 of them high or critical. 68 in total since records began. Checked packages: github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
Fixed in 2.11.57 and 3.7.13.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 63%Traefik HTTP/3 Backend NTLM Connection Reuse
Fixed in 2.11.57 and 3.7.13.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 53%Traefik entrypoint header-name sanitization bypassed via request trailers
Fixed in 3.7.13.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 63%Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
Fixed in 2.11.57 and 3.7.13.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 60%Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
Fixed in 2.11.53, 3.6.24 and 3.7.9.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 36%Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Fixed in 3.7.8.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 50%Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
Fixed in 2.11.52, 3.6.23 and 3.7.7.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 52%Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
Fixed in 3.6.25 and 3.7.10.
Affects github.com/traefik/traefik/v3 and github.com/traefik/traefik/v2.
EPSS: top 60%
All github.com/traefik/traefik/v3 advisories on OSV.devAll github.com/traefik/traefik/v2 advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 6.4 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 2 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- Unsigned releases (Signed-Releases 0/10)
- No fuzzing (Fuzzing 0/10)
Alternatives
Nginx
High-performance web server and reverse proxy
Strengths
- Extremely fast and lightweight
- Low resource usage
Trade-offs
- Configuration syntax can be complex
- Advanced features require Nginx Plus
HAProxy
Reliable, high-performance TCP/HTTP load balancer
Strengths
- Very high performance
- Advanced health checking
Trade-offs
- Configuration can be complex
- Less suitable for serving static content
AWS ALB
AWS Application Load Balancer for HTTP/HTTPS traffic
Strengths
- Fully managed by AWS
- Native AWS service integration
Trade-offs
- AWS vendor lock-in
- Limited customization
Envoy
Cloud-native high-performance edge and service proxy
Strengths
- Built for modern cloud-native architectures
- Advanced observability (metrics, tracing)
Trade-offs
- Complex configuration (requires API-based setup)
- Steeper learning curve than Nginx
Docs and release notes
Check Traefik in your own stack
This page checks Traefik in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.