# Envoy v1.38.6

> Networking & Messaging · 2026-10-06

A security maintenance release fixes two request-triggered crashes in Envoy filters. One unsafe request pattern is rejected with HTTP 400.

## Check if affected
- **[security]** GHSA-8vc2-jrm4-835w: `oauth2` filter handling for requests without `:path`
  - Applies if you use the `oauth2` filter.
  - The `oauth2` filter no longer crashes on requests without a `:path` header, including CONNECT requests. It rejects these requests with HTTP 400 in Envoy v1.38.6.
- **[security]** GHSA-47vj-9r25-wv5j: `api_key_auth` crash handling
  - Applies if you use `api_key_auth` with `hide_credentials` enabled and a `query` key source.
  - The `api_key_auth` filter no longer crashes when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header is authenticated through another key source. This fix ships in Envoy v1.38.6.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.6)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.6)