Important: Please read the migration guide. CVE fixed: Advisory GHSA-qqjf-53cj-pwvv Advisory GHSA-f52w-8j3h-j724 Advisory GHSA-v67p-phpq-fc8x Advisory GHSA-w4v4-9rw7-5326 Advisory GHSA-8fcf-v89g-xpg6 Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#13759 @ldez) [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @rtribotte) [acme] Do not require recursive nam…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-qqjf-53cj-pwvv Advisory GHSA-f52w-8j3h-j724 Advisory GHSA-w4v4-9rw7-5326 Bug fixes: [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @rtribotte) [http3] Dedicate a transport per HTTP/3 client connection (#13812 @sdelicata) [server] Deny request with an opaque request target (#13796 @sdelicata) [server…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-cjr6-pf59-jq29 Advisory GHSA-7ghq-v6jf-g56c Advisory GHSA-rf44-j88r-hh8c Bug fixes: [fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 (#13769 @mmatur) [file] Include the filename in file provider configuration errors (#13527 @lazerg) [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @gndz07)…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-7ghq-v6jf-g56c Advisory GHSA-rf44-j88r-hh8c Bug fixes: [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @gndz07) [server] Add an entry point option to handle request headers with aliasing names (#13720 @rtribotte) [tcp, udp] Reject negative weights in TCP and UDP weighted services (#13749 @rtribot…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Advisory GHSA-j994-9gqj-9hwq Advisory GHSA-m6wx-622r-48r9 Bug fixes: [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#13635 @gndz07) [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#13688 @jnoordsij) [k8s/crd] Prevent generated name collisions in the…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Bug fixes: [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte) [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte) [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD prov…
CVE fixed: Advisory GHSA-fgjj-px3w-67xx Advisory GHSA-62fc-8686-hfmq Advisory GHSA-6765-c87h-8mrf Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez) [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur) [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07) [tracing] Bump github.com/DataDog/dd-trace-go/v…
CVE fixed: Advisory GHSA-fgjj-px3w-67xx Advisory GHSA-62fc-8686-hfmq Advisory GHSA-6765-c87h-8mrf Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez) [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur) [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07) [tracing] Bump github.com/DataDog/dd-trace-go/v…
CVE fixed: Advisory GHSA-62fc-8686-hfmq Bug fixes: [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet) Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur) [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07) [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider (#13476 @AmariahAK) [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet) [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata) [server] Discard CONNECT body in forwardau…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt) [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet) [server] Defer the CONNECT payload until the backend…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata) [server] Bump google.golang.org/grpc to v1.82.1 (#13551 @piscue) [server] Do not add back CONNECT requests to the pool (#13…
CVE fixed: Advisory GHSA-8rxv-jg7p-wvg3 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#13506 @gndz07) [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt) [middleware] Fix panic in retry middleware with Websockets (#13520 @juliens) Document…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Advisory GHSA-42cj-m3vj-89wv Advisory GHSA-qq9q-x9w4-chhj Bug fixes: [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#13398 @dfeinblatt) [rules] Fix consistency between HostSNI() and Host() (#13460 @juliens) [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to…
CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Advisory GHSA-42cj-m3vj-89wv Bug fixes: [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte) [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet) [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07) [middleware] Fix handle empty unknown-length bodies…
CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Bug fixes: [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet) [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte) [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte) Documentation: Fix changelog v2.11.51 (#13430 @mmatur)
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) Bug fixes: [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez) [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates (#132…
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) Bug fixes: [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez) [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#13356 @AnatoleLucet) [k8s/gatewayapi] Ignore other g…
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) Bug fixes: [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens) [middleware, authentication] Add an option to remove request headers with underscores (#13262 @youkou…
CVE fixed: CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) Bug fixes: [k8s/ingress-nginx] Skip ingress when auth-secret resolution fails (#13323 @gndz07) [k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider (#13290 @Learloj) [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley) [server] Bu…
CVE fixed: CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) Bug fixes: [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley) [server] Bump to github.com/pires/go-proxyproto v0.12.0 (#13313 @timschumi) [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens) [tls] Fix snicheck for routers with no hosts (#13333 @rtrib…
Important: Please read the migration guide. CVE fixed: CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) Bug fixes: [tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte) [webui, tcp] Fix TCP router service resolution in dashboard flow diagram (#13155 @aliamerj) [k8s/ingress-nginx] Trim quo…
Bug fixes: [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens) [tls] Fix snicheck for routers with no hosts (#13333 @rtribotte)
Bug fixes: [middleware] Fix redis write timeout option configuration (#13273 @bzyy1024) [webui] Bump react-router and jsdom (#13301 @gndz07) [k8s/gatewayapi] Fix BackendTLSPolicy status update (#13306 @AnatoleLucet) [http3] Bump github.com/quic-go/quic-go to v0.59.1 (#13300 @rtribotte) [webui] Bump axios to v1.17.0 (#13299 @gndz07) [tls] Fix snicheck with keepalive (#13305 @juliens)
Bug fixes: [middleware] Fix redis write timeout option configuration (#13273 @bzyy1024) [webui] Bump react-router and jsdom (#13301 @gndz07) [k8s/gatewayapi] Fix BackendTLSPolicy status update (#13306 @AnatoleLucet) [http3] Bump github.com/quic-go/quic-go to v0.59.1 (#13300 @rtribotte) [webui] Bump axios to v1.17.0 (#13299 @gndz07) [tls] Fix snicheck with keepalive (#13305 @juliens)
Bug fixes: [http3] Bump github.com/quic-go/quic-go to v0.59.1 (#13300 @rtribotte) [webui] Bump axios to v1.17.0 (#13299 @gndz07) [tls] Fix snicheck with keepalive (#13305 @juliens)