v1.39.4 v1.40.0
envoyproxy/envoyOct 12, 2026 → Oct 13, 20261 day between releases
What's New
v1.40.0 adds HTTP/3 stability, post-quantum crypto, and migrates build system to Bazel bzlmod
Breaking Changes
- Build system migrated from WORKSPACE to Bazel bzlmod.
- LLVM/Clang toolchain bumped from version 18 to 22.
- Wasm runtime selection changed to --@proxy-wasm-cpp-host//bazel:engine.
- AWS-LC SSL library removed as selectable.
- mcp_router no longer forwards authorization header by default.
New Features
- HTTP/3 and QUIC listeners gain client-certificate (mTLS) support.
- New routing extensibility point route_specifiers for refining matched routes.
- New load balancing policies: per_worker_subset and load_aware_locality.
- AI Protocol Manager filter gains response-side LLM token-usage extraction.
- Dynamic modules gain cluster specifier, route specifier, and header formatter extension points.
Improvements
- Post-quantum hybrid key exchange (X25519MLKEM768) enabled by default.
- Security updates addressing multiple CVEs.
- Rust SDK updated.
Upgrade Notes
Migrate build system from WORKSPACE to MODULE.bazel and add the Envoy custom registry. Update Wasm runtime selection flags and remove AWS-LC support. Update Rust SDK code for HttpFilter signature changes.
The Two Releases
v1.39.4
Oct 12, 2026· 9 days ago
This release focuses on critical bug fixes addressing race conditions in route configuration management across various filters and components, including AWS, composite, and filter chain filters. It also resolves issues with dynamic modules, local rate limiting, SDS secrets, and Prometheus histogram bucket indices.
Full release notesv1.40.0
Oct 13, 2026· 8 days ago
Envoy v1.40.0 stabilizes HTTP/3 and QUIC, enables post-quantum cryptography by default, and migrates the build system to Bazel's `bzlmod`. It introduces extensive dynamic module extensibility, significant security hardening, and updates to the Rust SDK.
Full release notes