# Envoy v1.38.8

> Networking & Messaging · 2026-10-22

A security maintenance release removes trust in compromised eMudhra certificate authorities. The changes affect Envoy docker images, Envoy Mobile, and DNS-over-TLS or DNS-over-HTTPS upstreams using the built-in Hickory DNS resolver.

## Check if affected
- **[security]** Trust removal from Envoy docker images
  - Applies if you use Envoy docker images.
  - The Envoy docker images no longer trust the compromised eMudhra certificate authorities. This change ships in the Envoy docker images.
- **[security]** Envoy Mobile root certificate bundle with two roots removed
  - Applies if you use Envoy Mobile.
  - The root certificate bundle built into Envoy Mobile no longer includes `AAA Certificate Services` or `emSign ECC Root CA - G3`. This change ships in Envoy Mobile.
- **[security]** Updated Hickory DNS resolver trust roots
  - Applies if you use the built-in Hickory DNS resolver.
  - The `webpki-roots` and `rustls-webpki` crates used by the built-in Hickory DNS resolver were updated. DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate certificate authorities.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.8)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.8)