v1.39.2 v1.36.12
envoyproxy/envoyOct 1, 2026 → Oct 6, 20265 days between releases
What's New
Security patches prevent crashes in OAuth2 and API Key auth filters for CONNECT requests
Bug Fixes
- OAuth2 filter crash fix for CONNECT requests without a `:path` header
- API Key auth filter crash fix for specific conditions with `hide_credentials`
Upgrade Notes
This update applies security patches to the OAuth2 and API Key authentication filters to prevent crashes on CONNECT requests. Ensure your configuration handles requests without a `:path` header appropriately.
The Two Releases
v1.39.2
Oct 1, 2026· 20 days ago
This release updates BoringSSL to address a memory allocation denial-of-service vulnerability and updates build configurations by removing end-of-life Debian Bullseye support.
Full release notesv1.36.12
Oct 6, 2026· 16 days ago
This release applies security patches to the OAuth2 and API Key authentication filters to prevent crashes resulting from the absence of a `:path` header in CONNECT requests.
Full release notes