Envoy
v1.38.7Networking & MessagingOct 12, 2026
A maintenance release with a disclosed security dependency update and fixes for concurrency and metrics correctness. No operator configuration changes are announced.
Action needed (1)
securitylow
wasmtimeupdate for CVE-2026-54786Wasm support updates the
wasmtimedependency to24.to resolve CVE-2026-54786.0. 10
All 5 other recorded changesfixes 5
fixes (5)
- - aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration.
- - dynamic_modules: fixed a bug where the per-route config destroy hook could run on a worker thread, and the module could be unloaded there, when an RDS update replaced the route configuration.
- - local_ratelimit: fixed a race where the share provider manager owned by a local rate limit route-level configuration could be destroyed on a worker thread.
- - sds: fixed a race where a generic secret provider shared with worker threads could be destroyed on a worker thread.
- - stats: fixed a bug introduced in 1.38.0 that exported Prometheus native histogram bucket indices one bucket too low, causing consumers to decode observations into lower value ranges and underreport quantiles.
Add Envoy to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.