# Envoy v1.38.7

> Networking & Messaging · 2026-10-12

A maintenance release with a disclosed security dependency update and fixes for concurrency and metrics correctness. No operator configuration changes are announced.

## Action needed
- **[security · low]** `wasmtime` update for `CVE-2026-54786`
  - Wasm support updates the `wasmtime` dependency to `24.0.10` to resolve `CVE-2026-54786`.

## Other recorded changes
- 5 (defect_corrected 5)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.7)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.7)