CVE-2025-66490

The record

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.

Affected packages

Related vulnerabilities

• GO-2025-4206 Path Normalization Bypass in Traefik Router + Middleware Rules in… Same vulnerability
• GO-2026-4530 Traefik affected by TLS ClientAuth Bypass on HTTP/3 in github.com/traefik/traefik Also affects github.com/traefik/traefik
• GO-2026-4484 Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik Also affects github.com/traefik/traefik
• CVE-2026-25949 Traefik is an HTTP reverse proxy and load balancer. Also affects github.com/traefik/traefik
• GO-2026-4322 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall in… Also affects github.com/traefik/traefik
• CVE-2026-22045 Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall Also affects github.com/traefik/traefik
• GO-2025-4205 Traefik Inverted TLS Verification Logic in ingress-nginx Provider in… Also affects github.com/traefik/traefik
• CVE-2025-66491 Traefik has Inverted TLS Verification Logic in its ingress-nginx Provider Also affects github.com/traefik/traefik