v1.39.3
envoyproxy/envoyv1.39.3Oct 6, 2026by publish-envoy[bot]
Upgrading?
AI Summary
This release addresses critical security vulnerabilities in the OAuth2 and API Key authentication filters that could cause crashes when processing CONNECT requests missing a path header.
Key Highlights
- Fixes OAuth2 crash on requests without a `:path` header (GHSA-8vc2-jrm4-835w)
- Fixes API Key Auth crash when `hide_credentials` is enabled with specific configurations (GHSA-47vj-9r25-wv5j)
- Applies security patches to the v1.39.x series
Full Release Notes
**Summary of changes**:
* Security fixes:
- [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w):
oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`.
- [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j):
api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source.
**Docker images**:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.3
**Docs**:
https://www.envoyproxy.io/docs/envoy/v1.39.3/
**Release notes**:
https://www.envoyproxy.io/docs/envoy/v1.39.3/version_history/v1.39/v1.39.3
**Full changelog**:
https://github.com/envoyproxy/envoy/compare/v1.39.2...v1.39.3
Signed-off-by: wbpcode <wbphub@gmail.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>
Related Repositories
ggml-org/llama.cpp★ 131,943
LLM inference in C/C++
LadybirdBrowser/ladybird★ 66,606
Truly independent web browser
ClickHouse/ClickHouse★ 50,528
ClickHouse® is a real-time analytics database management system
LizardByte/Sunshine★ 42,488
Self-hosted game stream host for Moonlight.
deskflow/deskflow★ 29,979
Share a single keyboard and mouse between multiple computers.