Traefik 3.7.8

Traefik 3.7.8 has been released — and if you're running Traefik in production, this one's worth a careful look. It ships a security advisory fix alongside several bug fixes that address real-world pain points.

Security: CVE Fixed

The headline item in this release is a patched CVE: GHSA-8rxv-jg7p-wvg3. If you're behind on updates, this alone is reason enough to upgrade. Security patches in a reverse proxy are not something to sit on — the whole point of a tool like Traefik is to sit at the edge of your network, and that's exactly where you don't want unpatched vulnerabilities.

Bug Fixes Worth Noting

Let's walk through what else changed, because some of these fixes will save you a headache.

• Middleware + Kubernetes CRD: The missing ErrorRequestHeaders field has been added to the CRDs. If you've been wrestling with custom error pages in a Kubernetes setup, this one's for you.
• Ingress-Nginx sanitization: Rewritten targets on the ingress-nginx provider are now properly sanitized. This prevents malformed routes that could cause unexpected behavior.
• Log noise reduction: A fix removes unrelated errors about nonexistent certificate resolvers from the logs. Less noise means you can actually trust your log output again.
• WebSocket retry panic fix: The retry middleware with WebSockets could cause a panic under certain conditions. That's been resolved — so if you're doing WebSocket proxying, this is a must-have.

The Bottom Line

Traefik 3.7.8 isn't a feature release, and it doesn't pretend to be. It's a maintenance release that fixes real issues. That CVE fix alone makes it worth the upgrade, and the WebSocket panic fix is a close second. If you're already on 3.7.x, the upgrade is trivial. Run your usual rollout, check your logs afterward, and move on.

Available now on the GitHub releases page.