# Envoy v1.37.8

> Networking & Messaging · 2026-10-06

A security maintenance release fixes crashes in the Envoy `oauth2` and `api_key_auth` filters. The `oauth2` filter now rejects requests without a `:path` header with HTTP `400`, while the other fix covers a specific `hide_credentials` and query key source configuration.

## Check if affected
- **[security]** GHSA-8vc2-jrm4-835w in the `oauth2` filter
  - Applies if the `oauth2` filter receives requests without a `:path` header.
  - GHSA-8vc2-jrm4-835w fixes a crash in the `oauth2` filter for requests without a `:path` header, including `CONNECT` requests. The filter now rejects these requests with HTTP `400`.
- **[security]** GHSA-47vj-9r25-wv5j in the `api_key_auth` filter
  - Applies if `hide_credentials` is enabled with a `query` key source and a request without a `:path` header is authenticated via another key source.
  - GHSA-47vj-9r25-wv5j fixes a crash in the `api_key_auth` filter when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header is authenticated through another key source.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.37.8)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.8)