CVE fixed:

• Advisory GHSA-8rxv-jg7p-wvg3

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#13506 @gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#13520 @juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#13473 @veenoise)
• [rules] Fix syntax notes in routing rule documentation (#13501 @stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#13518 @rachana5)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv
• Advisory GHSA-42cj-m3vj-89wv
• Advisory GHSA-qq9q-x9w4-chhj

Bug fixes:

• [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#13398 @dfeinblatt)
• [rules] Fix consistency between HostSNI() and Host() (#13460 @juliens)
• [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace (#13462 @gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#13399 @amazon7737)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet)

Documentation:

• Fix version in migration guide (#13434 @kevinpollet)
• Fix changelog v2.11.51 (#13430 @mmatur)
• Add v3.7 to supported version docs (#13118 @jnoordsij)
• Fix some function names in comments (#13443 @blackflytech)
• Add @nandorKollar as a current maintainer (#13451 @emilevauge)
• Add @amazon7737 as a current maintainer (#13450 @emilevauge)
• [middleware] Clarify buffering middleware defaults (#13401 @amazon7737)
• Fix grammar in TLS, TCP service, and routing reference docs (#13461 @almightymoon)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#13472 @kevinpollet)

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv
• Advisory GHSA-42cj-m3vj-89wv

Bug fixes:

• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#13399 @amazon7737)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)

Documentation:

• [middleware] Clarify buffering middleware defaults (#13401 @amazon7737)
• Add @amazon7737 as a current maintainer (#13450 @emilevauge)
• Add @nandorKollar as a current maintainer (#13451 @emilevauge)
• Fix changelog v2.11.51 (#13430 @mmatur)
• Fix grammar in TLS, TCP service, and routing reference docs (#13461 @almightymoon)
• Fix some function names in comments (#13443 @blackflytech)
• Fix version in migration guide (#13434 @kevinpollet)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#13472 @kevinpollet)

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv

Bug fixes:

• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)

Documentation:

• Fix changelog v2.11.51 (#13430 @mmatur)

Important: Please read the migration guide.

CVE fixed:

• CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
• CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
• CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)

Bug fixes:

• [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez)
• [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens)
• [k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates (#13212 @nickmnt)
• [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#13356 @AnatoleLucet)
• [k8s/gatewayapi] Avoid collisions for Gateway API services names (#13367 @rtribotte)
• [k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways (#13397 @rtribotte)
• [k8s/ingress-nginx] Configure retry according to buffering configuration (#13039 @rtribotte)
• [k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream (#13386 @carloslima)
• [k8s] Detect EndpointSlice condition changes (#13405 @kevinpollet)
• [k8s] Index Kubernetes EndpointSlice by service name (#13395 @kevinpollet)
• [k8s] Sort endpointslices to keep backend IPs consistent across rebuilds (#13406 @kevinpollet)
• [kv] Bump kvtools/redis to v1.2.1 (#13403 @ldez)
• [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens)
• [middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses (#13360 @AnatoleLucet)
• [middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier (#12805 @mihuross)
• [middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme (#13347 @gndz07)
• [middleware] Fix CORS Max-Age set to 0 by default (#13371 @AnatoleLucet)
• [middleware] Fix CORS wildcard when allow-credentials is true (#13368 @AnatoleLucet)
• [server] Add an option to remove request headers with underscores (#13262 @youkoulayley)
• [server] Configurable max request header size (#13353 @juliens)
• [tls] Fix nondeterministic TLS certificate selection on shared SAN (#13348 @rtribotte)
• [webui] Bump axios to v1.18.0 (#13380 @gndz07)
• [websocket] Fix connection upgrades when backend server is using h2c scheme (#12967 @stffabi)

Documentation:

• [k8s/crd] Fix broken CRD reference links in IngressRoute page (#13375 @s3onghyun)
• [k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation (#13392 @jnoordsij)
• [k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list (#13372 @nmengin)
• [k8s] Align Helm chart documented values with chart v41 (#13366 @mloiseleur)
• [middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers (#13342 @rtribotte)
• [middleware] Clarify entryPoint middleware reference format (#13364 @mloiseleur)
• [security] Add HTTP/2 header memory exhaustion security documentation (#13381 @emilevauge)
• Adds documentations on maxHeaderBytes (#13363 @juliens)
• Fix inaccuracies in reference documentation (#13304 @sheddy-traefik)

Important: Please read the migration guide.

CVE fixed:

• CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
• CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

Bug fixes:

• [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez)
• [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens)
• [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#13356 @AnatoleLucet)
• [k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways (#13397 @rtribotte)
• [k8s] Detect EndpointSlice condition changes (#13405 @kevinpollet)
• [k8s] Index Kubernetes EndpointSlice by service name (#13395 @kevinpollet)
• [k8s] Sort endpointslices to keep backend IPs consistent across rebuilds (#13406 @kevinpollet)
• [kv] Bump kvtools/redis to v1.2.1 (#13403 @ldez)
• [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens)
• [middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier (#12805 @mihuross)
• [middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme (#13347 @gndz07)
• [middleware] Fix CORS Max-Age set to 0 by default (#13371 @AnatoleLucet)
• [middleware] Fix CORS wildcard when allow-credentials is true (#13368 @AnatoleLucet)
• [tls] Fix nondeterministic TLS certificate selection on shared SAN (#13348 @rtribotte)
• [server] Add an option to remove request headers with underscores (#13262 @youkoulayley)
• [server] Configurable max request header size (#13353 @juliens)
• [webui] Bump axios to v1.18.0 (#13380 @gndz07)
• [websocket] Fix connection upgrades when backend server is using h2c scheme (#12967 @stffabi)

Documentation:

• [k8s] Align Helm chart documented values with chart v41 (#13366 @mloiseleur)
• [k8s/crd] Fix broken CRD reference links in IngressRoute page (#13375 @s3onghyun)
• [k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list (#13372 @nmengin)
• [middleware] Clarify entryPoint middleware reference format (#13364 @mloiseleur)
• [security] Add HTTP/2 header memory exhaustion security documentation (#13381 @emilevauge)
• [server] Adds documentations on maxHeaderBytes (#13363 @juliens)
• Fix inaccuracies in reference documentation (#13304 @sheddy-traefik)

Important: Please read the migration guide.

CVE fixed:

• CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
• CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens)
• [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens)
• [middleware, authentication] Add an option to remove request headers with underscores (#13262 @youkoulayley)
• [webui] Bump axios to v1.18.0 (#13380 @gndz07)
• Configurable max request header size (#13353 @juliens)

Documentation:

• [security] Add HTTP/2 header memory exhaustion security documentation (#13381 @emilevauge)
• Adds documentations on maxHeaderBytes (#13363 @juliens)

CVE fixed:

• CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
• CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)

Bug fixes:

• [k8s/ingress-nginx] Skip ingress when auth-secret resolution fails (#13323 @gndz07)
• [k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider (#13290 @Learloj)
• [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley)
• [server] Bump to github.com/pires/go-proxyproto v0.12.0 (#13313 @timschumi)
• [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens)
• [tls] Fix snicheck for routers with no hosts (#13333 @rtribotte)

CVE fixed:

• CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)

Bug fixes:

• [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley)
• [server] Bump to github.com/pires/go-proxyproto v0.12.0 (#13313 @timschumi)
• [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens)
• [tls] Fix snicheck for routers with no hosts (#13333 @rtribotte)

Bug fixes:

• [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens)
• [tls] Fix snicheck for routers with no hosts (#13333 @rtribotte)