Starstruk Logo MarkStarstruk

v1.39.3 v1.36.13

high risk

envoyproxy/envoyOct 6, 2026 → Oct 12, 20266 days between releases

What's New

Downgrade from v1.39.3 to v1.36.13 is unsupported; adds security patches and race condition fixes.

Breaking Changes

  • Downgrade from v1.39.x to v1.36.x is unsupported due to API incompatibilities.

Improvements

  • Bumped wasmtime to 24.0.10 to resolve CVE-2026-54786
  • Fixed race conditions in AWS, local rate limit, and SDS filters

Bug Fixes

  • Fixed race condition in AWS request signing and Lambda filters
  • Fixed race condition in local rate limit share provider manager
  • Fixed race condition in SDS generic secret provider

Upgrade Notes

Downgrading from v1.39.x to v1.36.x is generally unsupported due to API changes; verify compatibility before proceeding.

The Two Releases

v1.39.3

v1.39.3

Oct 6, 2026· 15 days ago

This release addresses critical security vulnerabilities in the OAuth2 and API Key authentication filters that could cause crashes when processing CONNECT requests missing a path header.

Full release notes
v1.36.13

v1.36.13

Oct 12, 2026· 9 days ago

This release addresses a security vulnerability (CVE-2026-54786) by bumping the wasmtime dependency and resolves several race condition bugs in AWS, local rate limit, and SDS filters.

Full release notes