# Envoy v1.37.10

> Networking & Messaging · 2026-10-22

A security maintenance release removes trust in compromised eMudhra certificate authorities from `Envoy` Docker images and `Envoy Mobile`. The affected trust changes apply to the updated images and to `Envoy Mobile` when it uses its built-in certificate bundle.

## Check if affected
- **[security]** Updated `Envoy` Docker image trust
  - Applies if you use `Envoy` Docker images.
  - The `Envoy` Docker images no longer trust the compromised eMudhra certificate authorities. This security change ships in the updated `Envoy` Docker images.
- **[security]** `Envoy Mobile` root certificate bundle
  - Applies if you use `Envoy Mobile` with its built-in bundle.
  - `Envoy Mobile` removes the `AAA Certificate Services` and `emSign ECC Root CA - G3` roots from its built-in root certificate bundle. Servers whose certificate chains only lead to these roots are no longer trusted when `Envoy Mobile` uses its built-in bundle.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.37.10)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.10)