- Fixed critical CVE‑2026‑54763 and CVE‑2026‑54764 and added HTTP/2 header memory exhaustion security documentation.
- Resolved numerous bugs across ACME, Kubernetes EndpointSlice handling, middleware (CORS, RequestHeaderModifier, forward‑auth), TLS certificate selection, and WebSocket h2c upgrades.
- Introduced new features such as an option to remove request headers with underscores, configurable max request header size, added missing Gateway API features, updated provider list, and aligned Helm chart documentation.
v3.6.22
Official Traefik changelog summary with source attribution, release tags, and community reactions.
Track this Traefik release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Traefik release note into a weekly digest for the tools you actually use.
Create digestMore Traefik changelog updates
Bumped multiple dependencies (acme/lego, DataDog/dd-trace-go, golang.org/x/text, etc.) to newer versions.
Fixed authentication singleflight key collision and router name collisions in Kubernetes Gateway API provider.
Updated tracing library to dd-trace-go v2.8.1 and upgraded golang.org/x/text and x/net packages