# Envoy v1.40.1

> Networking & Messaging · 2026-10-23

A security-focused patch removes trust in compromised certificate authorities and updates resolver dependencies. It also corrects Istio peer metadata behavior so peer app and version values again use the `app` and `version` labels, with Kubernetes labels as fallback.

## Check if affected
- **[security]** Trust in compromised eMudhra CAs removed from Envoy docker images
  - Applies if you use Envoy docker images.
  - The Envoy docker images no longer trust the compromised eMudhra CAs.
- **[security]** Certificate roots removed from the Envoy Mobile built-in bundle
  - Applies if you use Envoy Mobile with its built-in bundle.
  - The `AAA Certificate Services` and `emSign ECC Root CA - G3` roots were removed from the root certificate bundle built into Envoy Mobile. Certificate chains that lead only to these roots are no longer trusted by Envoy Mobile.
- **[security]** Resolver dependency updates remove trust in compromised eMudhra intermediate CAs
  - Applies if you use the built-in Hickory DNS resolver.
  - The `webpki-roots` and `rustls-webpki` crates used by the built-in Hickory DNS resolver were updated. DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate CAs.

## Other recorded changes
- 1 (value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.40.1)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.40.1)