v1.36.12 v1.37.8
low risk
envoyproxy/envoyOct 6, 2026 → Oct 6, 20260 days between releases
What's New
Both releases fix the same security vulnerabilities in OAuth2 and API Key auth filters.
Upgrade Notes
Upgrading from v1.36.12 to v1.37.8 applies the same security patches. No configuration changes are required based on the release notes.
The Two Releases
v1.36.12
v1.36.12
Oct 6, 2026· 16 days ago
This release applies security patches to the OAuth2 and API Key authentication filters to prevent crashes resulting from the absence of a `:path` header in CONNECT requests.
Full release notesv1.37.8
v1.37.8
Oct 6, 2026· 15 days ago
Addresses a security vulnerability in the OAuth2 and API Key authentication filters that could lead to crashes resulting from the absence of a `:path` header in CONNECT requests.
Full release notes