# Envoy v1.36.12

> Networking & Messaging · 2026-10-06

A security maintenance release fixes two Envoy filter crash vulnerabilities. The `oauth2` filter now rejects malformed requests without a `:path` header with HTTP `400`.

## Check if affected
- **[security]** GHSA-8vc2-jrm4-835w in the `oauth2` filter
  - Applies if you use the `oauth2` extension.
  - GHSA-8vc2-jrm4-835w fixes a crash in the `oauth2` filter for requests without a `:path` header, including CONNECT requests. The filter now rejects these requests with HTTP `400`.
- **[security]** GHSA-47vj-9r25-wv5j in the `api_key_auth` filter
  - Applies if you use the `api_key_auth` extension, configure `hide_credentials`, and configure `query`.
  - GHSA-47vj-9r25-wv5j fixes a crash in the `api_key_auth` filter when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header is authenticated through another key source.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.36.12)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.36.12)