# Envoy v1.39.5

> Networking & Messaging · 2026-10-23

A targeted security release removes trust in compromised eMudhra certificate authorities from Envoy images, Envoy Mobile, and selected DNS resolver dependencies. It also restores peer metadata conversion to use the peer's `app` and `version` labels before falling back to Kubernetes labels.

## Check if affected
- **[security]** Envoy docker image trust removal
  - Applies if you use Envoy docker images.
  - The Envoy docker images no longer trust the compromised eMudhra certificate authorities.
- **[security]** Envoy Mobile root certificate removal
  - Applies if you use Envoy Mobile.
  - The root certificate bundle built into Envoy Mobile no longer includes `AAA Certificate Services` or `emSign ECC Root CA - G3`.
- **[security]** Hickory DNS resolver certificate trust
  - Applies if you use the built-in Hickory DNS resolver with DNS-over-TLS upstreams and DNS-over-HTTPS upstreams.
  - The `webpki-roots` and `rustls-webpki` crates used by the built-in Hickory DNS resolver were updated. DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate certificate authorities.

## Other recorded changes
- 1 (value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.39.5)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.39.5)