Medium severity · published Dec 9, 2025
CVE-2025-66490
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
traefik · traefik
github.com/traefik/traefik/v3 < 3.6.3; github.com/traefik/traefik/v2 < 2.11.32; github.com/traefik/traefik <= 1.7.34 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66490
Release Notes
https://github.com/traefik/traefik/releases/tag/v2.11.32
Release Notes
https://github.com/traefik/traefik/releases/tag/v3.6.4
Exploit
https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c
More from traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass