Envoy
v1.36.13Networking & MessagingOct 12, 2026
A security maintenance release updates Wasmtime and fixes several race conditions in AWS request signing, AWS Lambda, local rate limiting, and secret distribution. It introduces no newly enforced configuration or behavioral requirements.
Action needed (1)
securitylowThe
wasmtimedependency update for CVE-2026-54786wasmtimewas updated to24.to resolve CVE-2026-54786.0. 10
All 3 other recorded changesfixes 3
fixes (3)
- - aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration.
- - local_ratelimit: fixed a race where the share provider manager owned by a local rate limit route-level configuration could be destroyed on a worker thread.
- - sds: fixed a race where a generic secret provider shared with worker threads could be destroyed on a worker thread.
Add Envoy to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.