# Envoy v1.40.0

> Networking & Messaging · 2026-10-13

A major release with breaking build and default changes, security fixes, and expanded protocol, extension, authentication, and observability support. The affected areas include builds using removed options, deployments relying on changed defaults, and configurations that use the listed protocol and security components.

## Action needed
- **[security]** The 1.39.x security fixes
  - The release carries forward the 1.39.x security fixes for URL normalization of path parameters (`CVE-2026-73511`, `CVE-2026-73551`), HTTP/2 trailers without `END_STREAM` and dropped-`Host` accounting (`CVE-2026-73513`, `CVE-2026-73550`), HTTP/3 UAF (`CVE-2026-73512`), ext_authz pathless-request crashes and UAF (`CVE-2026-73547`, `CVE-2026-50572`), generic-upgrade body pipelining (`CVE-2026-73548`), safe_regex Latin1 mode (`CVE-2026-73552`), RBAC `ignore_path_parameters` (`CVE-2026-73553`), admin stat-name sanitization (`CVE-2026-73546`), and oauth2/api_key_auth CONNECT crashes (`GHSA-8vc2-jrm4-835w`, `GHSA-47vj-9r25-wv5j`).
- **[breaking]** The `Clang/libc++` build default
  - `Clang/libc++` is now the default and no flag is required to select it.
- **[breaking]** The container-aware CPU detection default
  - `Container-aware CPU detection` is enabled by default.
- **[breaking]** The `QUERY` `Content-Type` requirement
  - `QUERY` requests without `Content-Type` are rejected on all protocols.

## Check if affected
- **[security]** Path-traversal protection in the `JSON/REST bridge`
  - Applies if you run the `JSON/REST bridge`.
  - The `JSON/REST bridge` now prevents path traversal via template variables.
- **[breaking]** The `--config=clang` and `clang-local` flags, removed
  - Applies if you use `--config=clang` or `clang-local`.
  - `--config=clang` and `clang-local` are removed.
- **[breaking]** The C++ library selection options, removed
  - Applies if you use `--@envoy//bazel:libc++`, `libstdc++`, or `force_libcpp`.
  - The `--@envoy//bazel:libc++`, `libstdc++`, and `force_libcpp` options are removed.
- **[breaking]** The Wasm runtime engine selection flag
  - Applies if you use `--define wasm=` or `--define engine=`.
  - The Wasm runtime is selected with `--@proxy-wasm-cpp-host//bazel:engine=<engine>`. The older `--define wasm=` and `--define engine=` flags now fail the build.
- **[breaking]** The `AWS-LC` SSL library selection
  - Applicability is not stated in the release notes.
  - `AWS-LC` is removed as a selectable SSL library, including `--config=aws-lc-fips`. ppc64le builds should use `--config=openssl`.
- **[breaking]** The `mcp_router` downstream header-forwarding default
  - Applies if you run `mcp_router`.
  - Downstream request headers are no longer forwarded to backends by default in `mcp_router`.
- **[breaking]** The default ECDH curves and `X25519MLKEM768`
  - Applies if you do not configure `envoy.reloadable_features.pqc_default_ecdh_curves`.
  - `X25519MLKEM768` is added to the default ECDH curves when `envoy.reloadable_features.pqc_default_ecdh_curves` is not configured.
- **[breaking]** The `WORKSPACE` to `MODULE.bazel` build configuration
  - Applies if you configure `WORKSPACE`.
  - The `WORKSPACE` file is removed. Envoy, its API, and its documentation are published as Bazel modules.

## Other recorded changes
- 29 (added 16, defect_corrected 8, value_changed 2, constraint_changed 2, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.40.0)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.40.0)