v1.33.13

envoyproxy/envoyv1.33.13Dec 3, 2025by publish-envoy[bot]

AI Summary

This release addresses three security vulnerabilities, including a crash in JWT authentication with remote JWKS fetching, a potential null byte issue in TLS certificate matching, and a request smuggling vulnerability related to early data.

Key Highlights

Fix for JWT authentication crash when using remote JWKS fetching
Fix for TLS certificate matcher incorrectly treating null bytes
Fix for potential request smuggling via early data after CONNECT upgrade

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2025-64527](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866): Envoy crashes when JWT authentication is configured with the remote JWKS fetching
  - [CVE-2025-66220](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
  - [CVE-2025-64763](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh): Potential request smuggling from early data after the CONNECT upgrade

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.13
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.33.13/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.33.13/version_history/v1.33/v1.33.13
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.33.12...v1.33.13

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>