GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-ww7c-q3mv-xx22 · Runtime
FIX → v3.7.15
When a backend accepts a protocol upgrade such as WebSocket, Traefik's experimental FastProxy reads the same buffered connection from two places with no locking. An unauthenticated client that repeatedly opens and aborts upgraded connections can corrupt that reader and crash the Traefik process, causing denial of service.
first public Oct 16, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that enable the experimental FastProxy feature (experimental.fastProxy) are exposed; Traefik v2 is not affected because FastProxy arrived in v3.2. Teams running Traefik v3.2 through v3.7.14 with that flag set should look at their proxy in front of backends that use WebSocket or other protocol upgrades. Teams without the flag enabled can skip it.
Not affected if default-config, traefik-v2
Who cares kubernetes, self-hosted, traefik, websocket
traefik version and compare it against the affected range >= v3.2.0, <= v3.7.14.experimental.fastProxy; only deployments with it enabled are affected.Upgrade to v3.7.15
There is a high severity vulnerability in Traefik's experimental FastProxy (experimental.fastProxy). Once a backend answers a protocol upgrade (101 Switching Protocols, e.g. WebSocket), the connection pool keeps reading from the backend connection while the tunnel copier reads from the same buffered reader, with no synchronization between them. An unauthenticated client that repeatedly opens upgraded connections and aborts them can corrupt the reader's internal state and trigger an unrecovered panic that terminates the whole Traefik process, causing a denial of service.
Only deployments that enable experimental.fastProxy are affected. Traefik v2 is not affected, as FastProxy was introduced in v3.2. Traefik v3.2 to v3.6 are affected and no longer maintained, so they will not receive a patch: users on those versions should upgrade to a patched v3.7 release.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.7.15 (the fixed version in the v3.7 line).