Starstruk Logo MarkStarstruk

v3.7.9

aigc3d/LAMv3.7.9Jul 24, 2026by github-actions[bot]

AI Summary

This release addresses a security vulnerability (CVE GHSA-3ccp-42pg-hgv6) and fixes bugs related to Kubernetes Ingress-Nginx, middleware Zstd support, and server connectivity for CONNECT requests.

Key Highlights

  • Fixes CVE GHSA-3ccp-42pg-hgv6
  • Fixes redirect issues with use-regex in IngressNGINX provider
  • Updates google.golang.org/grpc to v1.82.1
  • Modifies CONNECT request handling (defer payload, discard body, reject fast proxy)
  • Disables Zstd support in the gzhttp wrapper

Breaking Changes

  • Discard CONNECT body in forwardauth
  • Reject CONNECT requests with fast proxy
  • Disable Zstd support in the gzhttp wrapper

Full Release Notes

**Important:** Please read the [migration guide](https://doc.traefik.io/traefik/v3.7/migrate/v3/#v379).

**CVE fixed:**
- Advisory [GHSA-3ccp-42pg-hgv6](https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6)

**Bug fixes:**
- **[k8s/ingress-nginx]** Fix redirect with use-regex in IngressNGINX provider ([#13476](https://github.com/traefik/traefik/pull/13476) @AmariahAK)
- **[middleware]** Disable Zstd support in the gzhttp wrapper ([#13533](https://github.com/traefik/traefik/pull/13533) @kevinpollet)
- **[server]** Defer the CONNECT payload until the backend accepts the tunnel ([#13542](https://github.com/traefik/traefik/pull/13542) @sdelicata)
- **[server]** Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ([#13543](https://github.com/traefik/traefik/pull/13543) @sdelicata)
- **[server]** Bump google.golang.org/grpc to v1.82.1 ([#13551](https://github.com/traefik/traefik/pull/13551) @piscue)
- **[server]** Do not add back CONNECT requests to the pool ([#13556](https://github.com/traefik/traefik/pull/13556) @kevinpollet)

**Documentation:**
- **[k8s/gatewayapi]** Document Gateway API generated service names change in the migration guide ([#13541](https://github.com/traefik/traefik/pull/13541) @rtribotte)
- **[k8s/ingress-nginx]** Fix typo in nginx annotation proxy-buffer-numbers ([#13545](https://github.com/traefik/traefik/pull/13545) @fischerman)
- Add a migration note for CONNECT requests ([#13554](https://github.com/traefik/traefik/pull/13554) @kevinpollet)