v1.37.8 v1.38.6

Name: envoy
Author: envoyproxy

low risk

envoyproxy/envoyOct 6, 2026 → Oct 6, 20260 days between releases

What's New

Identical security fixes prevent crashes in OAuth2 and API Key filters for CONNECT requests lacking a `:path` header.

Bug Fixes

Fixes crash in OAuth2 filter for CONNECT requests without a `:path` header.
Fixes crash in API Key Auth filter when `hide_credentials` is enabled with a query key source.

Upgrade Notes

No configuration changes are required; this is a security patch update.

The Two Releases

v1.37.8

Oct 6, 2026· 15 days ago

Addresses a security vulnerability in the OAuth2 and API Key authentication filters that could lead to crashes resulting from the absence of a `:path` header in CONNECT requests.

Full release notes

v1.38.6

Oct 6, 2026· 15 days ago

This release includes security updates to prevent crashes in the OAuth2 and API Key authentication filters when handling CONNECT requests that lack a `:path` header.

Full release notes