Envoy

v1.38.6Networking & Messaging

Oct 6, 2026

A security maintenance release fixes two request-triggered crashes in Envoy filters. One unsafe request pattern is rejected with HTTP 400.

Check if affected (2)

securityGHSA-8vc2-jrm4-835w: oauth2 filter handling for requests without :path
Applies if you use the oauth2 filter.
The oauth2 filter no longer crashes on requests without a :path header, including CONNECT requests. It rejects these requests with HTTP 400 in Envoy v1.38.6.
GHSA-8vc2-jrm4-835w
securityGHSA-47vj-9r25-wv5j: api_key_auth crash handling
Applies if you use api_key_auth with hide_credentials enabled and a query key source.
The api_key_auth filter no longer crashes when hide_credentials is enabled with a query key source and a request without a :path header is authenticated through another key source. This fix ships in Envoy v1.38.6.
GHSA-47vj-9r25-wv5j

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.