# New Security Update for Traefik 2.11 (2.11.52) and 3.7 (3.7.12)

**URL:** <https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-52-and-3-7-3-7-12/30211>\
**Category:** Announcements\
**Created:** [August 27, 2026, 8:31am UTC](https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-52-and-3-7-3-7-12/30211 "2026-08-27T08:31:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicomengin](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nicomengin/32/5507_2.png) [@nicomengin](https://community.traefik.io/u/nicomengin)\
**Post date:** [August 27, 2026, 8:31am UTC](https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-52-and-3-7-3-7-12/30211/1 "2026-08-27T08:31:05Z")

</div>

On August 26, 2026, we patched the following vulnerabilities in Traefik Proxy 2.11.56 and 3.7.12:

- Advisory [GHSA-cjr6-pf59-jq29](https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29) (CVE pending) — fixed in 3.7.12
- Advisory [GHSA-7ghq-v6jf-g56c](https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c) (CVE pending) — fixed in 2.11.56 and 3.7.12
- Advisory [GHSA-rf44-j88r-hh8c](https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c) (CVE pending) — fixed in 2.11.56 and 3.7.12

Two notes on this update:

- The fix for [GHSA-rf44-j88r-hh8c](https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c) is a new entry point option, `aliasHeadersStrategy`. It defaults to `keep`, which preserves the previous behavior, so upgrading alone does not change anything: set it to `delete` or `reject` on your entry points for the mitigation to take effect. See [Headers with Aliasing Names](https://doc.traefik.io/traefik/security/header-aliases/).
- Traefik 3.6 reached end of security support on August 16, 2026 and does not receive a patch for these advisories. If you are on 3.6 or older, upgrade to 3.7.12. Traefik 2.11 reaches end of security support on September 7, 2026.

If you have any questions or comments about these vulnerabilities, please add a comment.