v1.37.9 v1.38.7
envoyproxy/envoyOct 12, 2026 → Oct 12, 20260 days between releases
What's New
Adds fixes for dynamic modules and Prometheus histogram reporting alongside security updates.
Improvements
- Bumped wasmtime to 24.0.10 to resolve CVE-2026-54786.
- Fixed Prometheus native histogram bucket indices to prevent quantile underreporting.
- Fixed race conditions in dynamic module unload hooks during RDS updates.
Bug Fixes
- Fixed race condition in AWS request signing and Lambda filters during RDS updates.
- Fixed race condition in local rate limiting share provider manager during RDS updates.
- Fixed race condition in SDS generic secret provider during RDS updates.
- Fixed Prometheus histogram reporting bug causing bucket indices to be one too low.
- Fixed race condition where dynamic module unload hooks ran on worker threads.
Upgrade Notes
The wasmtime dependency remains at 24.0.10. The Prometheus histogram metrics will now report correct bucket indices, which may shift observed quantiles. No configuration changes are required.
The Two Releases
v1.37.9
Oct 12, 2026· 9 days ago
This release addresses a security vulnerability (CVE-2026-54786) by bumping the wasmtime dependency and resolves several race condition bugs in AWS, local rate limit, and SDS filters.
Full release notesv1.38.7
Oct 12, 2026· 9 days ago
This release focuses on security updates and critical bug fixes, particularly addressing race conditions in AWS, dynamic modules, and local rate limiting configurations during route updates. It also includes a fix for Prometheus histogram reporting and bumps the Wasmtime dependency to address a specific CVE.
Full release notes