Risks in Traefik 3.3 release for Nginx and HAProxy users

The Ingress-NGINX vacuum and Traefik security flaws

The retirement of Ingress-NGINX on March 24, 2026, forced platform teams to evaluate Traefik, NGINX, and HAProxy while managing the security implications of running unmaintained code at the network edge. Kubernetes SIG Network and the Security Response Committee flagged the move in November 2025 before pulling the plug in March 2026. The Kubernetes Steering Committee published a follow-up statement in January 2026 to acknowledge that Ingress-NGINX was critical infrastructure for about half of cloud-native environments. By late February 2026, Kubernetes published a warning about Ingress-NGINX behaviors that do not translate cleanly to other controllers. Traefik 3.3 users face immediate security risks due to several vulnerabilities identified in September 2026. CVE-2026-85594 is a critical flaw that allows a namespace-limited tenant to attach an operator-owned middleware to their Service and recover backend credentials. CVE-2026-85595 is a critical authentication bypass in the digestAuth middleware where unknown usernames receive an empty secret. CVE-2026-88008 is a critical vulnerability that allows an unauthenticated request to reach protected paths on a backend using h2c upgrades. CVE-2026-88007 is a critical issue where an unrelated client is able to reuse a backend connection authenticated for a victim through HTTP/3 entrypoint flaws. CVE-2026-85596 is a critical vulnerability where Traefik treats conflicting TLS options as a conflict and falls back to the entry point’s default configuration. CVE-2026-88009 is a high-severity vulnerability that allows cross-vhost routing bypass and path-scoped authorization bypass. CVE-2026-88011 is a high-severity issue where a client-supplied header survives ForwardAuth replacement to allow identity spoofing. CVE-2026-71327 is a high-severity issue where identity collisions in the Kubernetes Gateway API provider allow colliding routes to overwrite another namespace’s backend. CVE-2026-67309 is a high-severity path traversal vulnerability in the Kubernetes Ingress NGINX provider’s RewriteTarget middleware. To mitigate the transition, the project released Ingress2Gateway 1.0 in March 2026 to translate manifests into Gateway API resources.

Performance and configuration trade-offs

Teams evaluate these three options based on specific performance and configuration requirements. Traefik provides over 90% annotation coverage for existing Ingress-NGINX users, while NGINX and HAProxy require teams to rewrite ingress rules.

Reintech’s 2026 comparison notes that HAProxy edges out the competition in raw throughput while NGINX is not far behind. Traefik requires more pods to handle identical loads because its overhead is higher than the others. You should consider how your traffic shape dictates these choices. HAProxy is a strong choice where teams want fewer surprises under load. NGINX is a reliable option for managing large-scale applications and traffic spikes well. Traefik targets mid-size SaaS platforms that want lower cognitive overhead. Regarding pricing, none of the three vendors publish exact enterprise costs on their websites as of 2026. Companies should expect a sales conversation rather than a self-serve checkout. The performance gap between Traefik and NGINX is visible in benchmarks showing a 42K versus 19K requests per second difference. NGINX is widely used for running over 350 million websites and provides a large pool of experienced engineers. HAProxy is the pick for performance-sensitive API traffic and teams that trust HAProxy in front of critical systems. NGINX handles SSL/TLS termination and compression to improve the user experience. Does the transition to Gateway API make these decisions obsolete?

Upgrade paths and resource usage

Traefik 3.3 users face a significant risk when they update the Kubernetes CRDs to version 3.4 because the new default value for the strategy field causes all remaining 3.3 pods to fail during configuration reloads. The 3.4 upgrade introduces a default value that 3.3 does not recognize, making the update difficult for clusters with multiple Traefik deployments. This issue forces teams to manually set the RoundRobin value to maintain compatibility. If a team updates the CRDs before the pods, the pods will error out on loading configuration updates. HAProxy users encounter different issues during rolling restarts. When teams use many backend servers per backend, HAProxy consumes significant memory. For example, a user with 50 servers per backend and 800 IngressRoutes with 5,000 total rules experienced large RAM spikes. An unrelated client-side bug in one case led to leaked connections and 3MB of RAM usage per connection. HAProxy memory consumption increases until old processes close open connections. NGINX is a high-performance option that manages the volume of traffic well, but it requires manual configuration for many advanced features.