RATATOSKRATATOSK
Sign in

Envoy

v1.40.0Networking & Messaging
Oct 13, 2026

ACTION 4CHECK 8OTHER 29

A major release with breaking build and default changes, security fixes, and expanded protocol, extension, authentication, and observability support. The affected areas include builds using removed options, deployments relying on changed defaults, and configurations that use the listed protocol and security components.

Action needed (4)

Check if affected (8)

  • securityPath-traversal protection in the JSON/REST bridge

    Applies if you run the JSON/REST bridge.

    The JSON/REST bridge now prevents path traversal via template variables.

  • breakingThe --config=clang and clang-local flags, removed

    Applies if you use --config=clang or clang-local.

    --config=clang and clang-local are removed.

  • breakingThe C++ library selection options, removed

    Applies if you use --@envoy//bazel:libc++, libstdc++, or force_libcpp.

    The --@envoy//bazel:libc++, libstdc++, and force_libcpp options are removed.

  • breakingThe Wasm runtime engine selection flag

    Applies if you use --define wasm= or --define engine=.

    The Wasm runtime is selected with --@proxy-wasm-cpp-host//bazel:engine=<engine>. The older --define wasm= and --define engine= flags now fail the build.

  • breakingThe AWS-LC SSL library selection

    Applicability is not stated in the release notes.

    AWS-LC is removed as a selectable SSL library, including --config=aws-lc-fips. ppc64le builds should use --config=openssl.

  • breakingThe mcp_router downstream header-forwarding default

    Applies if you run mcp_router.

    Downstream request headers are no longer forwarded to backends by default in mcp_router.

  • breakingThe default ECDH curves and X25519MLKEM768

    Applies if you do not configure envoy.reloadable_features.pqc_default_ecdh_curves.

    X25519MLKEM768 is added to the default ECDH curves when envoy.reloadable_features.pqc_default_ecdh_curves is not configured.

  • breakingThe WORKSPACE to MODULE.bazel build configuration

    Applies if you configure WORKSPACE.

    The WORKSPACE file is removed. Envoy, its API, and its documentation are published as Bazel modules.

All 29 other recorded changesadditions 16 · fixes 8 · constraints 2 · value changes 2 · defaults 1

additions (16)

  • QUIC listeners gain client-certificate (mTLS) support, upstream QUIC gains client certificates, and P-384/P-521 ECDSA curves are supported.
  • new route_specifiers extension point post-processes (refines, drops, or synthesizes) the matched route
  • new per_worker_subset policy
  • new load_aware_locality policy
  • gains response-side LLM token-usage extraction for OpenAI, Anthropic and Gemini dialects (SSE and JSON), published as typed dynamic metadata (envoy.data.ai.v3.TokenUsage), plus request-info, schema-validation and transcoding sub-filters and body re-serialization.
  • MCP filter: per-route config, protocol-version enforcement, required client capabilities, new method groups, no-op mode and early termination when routable.
  • New extension points: cluster specifier, route specifier, header formatter, early header mutation, TLS handshaker, transport-socket relay, config validator, and downstream STARTTLS.
  • Typed metadata get/set, runtime getters, tracing spans across hooks, stream timing, upstream attempt/peer-address accessors, and Go SDK stats/log-level getters.
  • TLS: per-certificate TLS params, multiple upstream certificates with a certificate selector, SPIFFE upstream SAN validation, SDS file polling, and upstream session cache scoped by SNI.
  • OAuth2 gains assertion audience/key-id and TLS client auth for the credential injector; JWT auth gains claim paths and a JWT-claim rate-limit descriptor; GCP auth gains scopes, audiences and IAM access tokens; ext_authz gains shadow mode on the network filter and route-cache-clearing headers.
  • Access logs: downstream handshake time points and connection RTT, listener name and route-resolution-time formatters, CEL-expression formatter config, and nanosecond histogram units.
  • OpenTelemetry: resource detectors, custom exporters, instrumentation scope, and typed custom tags; ext_authz and ext_proc emit client spans.
  • Stats: per-cluster/listener stats matchers, explicit tags
  • Redis proxy: RESP3 protocol support, CLUSTER SHARDS
  • Reverse tunnels: JWT handshake auth, maintain interval, fail-closed identifier validation
  • Watchdog backtrace action, UDP health checker, multi-health-checker, TCP proxy load-shed points, and a body-size-limit HTTP filter.

fixes (8)

  • This closes a use-after-free on synchronous filter-chain teardown.
  • Broad hardening: a large batch of lifetime/view fixes across HTTP, network, listener and cluster-LB filter state
  • a fix for Prometheus native-histogram bucket indices being off by one.
  • several use-after-free fixes.
  • a batch of handshake lifecycle fixes.
  • Fixed a family of races where route-level configuration (AWS signing, composite, filter chain, local ratelimit, dynamic modules, SDS secrets) could be destroyed on a worker thread after an RDS update.
  • which also fixes inbound-only drain for the Mongo/Redis/Thrift/generic proxies
  • connectionless listeners no longer go dark during drain

constraints (2)

  • Dynamic-module clusters can now delegate host selection to Envoy's built-in LBs (ROUND_ROBIN, LEAST_REQUEST, RANDOM, RING_HASH, MAGLEV).
  • HTTP/1 now accepts the RFC 10008 QUERY method

value changes (2)

  • the hermetic LLVM/Clang toolchain is bumped from 18 to 22
  • HTTP/3 and QUIC are now stable

defaults (1)

  • coalesced LB rebuilds on EDS batch updates are now on by default
Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Envoy releases →