Envoy
v1.37.9Networking & MessagingOct 12, 2026
A maintenance release with a disclosed security dependency update and fixes for concurrency bugs. It contains no announced operator configuration changes.
Action needed (1)
securitylowThe
wasmtimedependency update for CVE-2026-54786The
wasmtimedependency was updated to24.to resolve CVE-2026-54786.0. 10
All 3 other recorded changesfixes 3
fixes (3)
- - aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration.
- - local_ratelimit: fixed a race where the share provider manager owned by a local rate limit route-level configuration could be destroyed on a worker thread.
- - sds: fixed a race where a generic secret provider shared with worker threads could be destroyed on a worker thread.
Add Envoy to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.