UpHeron
All vulnerabilities

Servers and applications

CVE-2025-66490

Path Normalization Bypass in Traefik Router + Middleware Rules

Severity
Medium 6.9
Published
8 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.32, 3.6.3
Also known as
GHSA-gm3x-23wp-hc2c
Sources
NVD, Project advisories (GitHub)

Description

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to…

Affected software

SoftwareAffected versions
TraefikServers and applications · cpe:a:traefik:traefik
  • Every version before 2.11.32
  • From 3.0.0 before 3.6.3
TraefikServers and applications · github:traefik/traefik
  • Every version up to 1.7.34
  • Every version before 2.11.32
  • Every version before 3.6.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-66490
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-66490
  • GitHub Advisory Database https://github.com/advisories/GHSA-gm3x-23wp-hc2c
  • github.com https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c