# Envoy v1.39.3

> Networking & Messaging · 2026-10-06

A security maintenance release fixes two Envoy filter crashes. The fixes include safer handling of CONNECT requests without a `:path` header.

## Check if affected
- **[security]** GHSA-8vc2-jrm4-835w in the `oauth2` filter
  - Applies to CONNECT requests without a `:path` header.
  - The `oauth2` filter now rejects requests without a `:path` header with `400`. This fixes GHSA-8vc2-jrm4-835w.
- **[security]** GHSA-47vj-9r25-wv5j in the `api_key_auth` filter
  - Applies if `hide_credentials` is enabled with a `query` key source.
  - The `api_key_auth` filter crash is fixed for requests without a `:path` header that are authenticated through another key source when `hide_credentials` is enabled with a `query` key source. This addresses GHSA-47vj-9r25-wv5j.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.39.3)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.39.3)