v1.38.6 v1.39.3

Name: envoy
Author: envoyproxy

low risk

envoyproxy/envoyOct 6, 2026 → Oct 6, 20260 days between releases

What's New

No new changes between v1.38.6 and v1.39.3; both fix the same OAuth2 and API Key security vulnerabilities

Bug Fixes

OAuth2 filter crash fixed for CONNECT requests without a :path header
API Key Auth crash fixed when hide_credentials is enabled with query key source

Upgrade Notes

The security vulnerabilities fixed in v1.38.6 are identical to those addressed in v1.39.3, so upgrading provides no additional coverage against these specific CVEs.

The Two Releases

v1.38.6

Oct 6, 2026· 15 days ago

This release includes security updates to prevent crashes in the OAuth2 and API Key authentication filters when handling CONNECT requests that lack a `:path` header.

Full release notes

v1.39.3

Oct 6, 2026· 15 days ago

This release addresses critical security vulnerabilities in the OAuth2 and API Key authentication filters that could cause crashes when processing CONNECT requests missing a path header.

Full release notes