Envoy Proxy Releases v1.38.7 with Security Fixes and Bug Fixes
1 min read
•
Impact: 5/10
•
Zero Trackers
Key Takeaway
Envoy Proxy version 1.38.7 has been released, addressing a security vulnerability and several bugs.
Summary
The Envoy Proxy project has released version 1.38.7, which includes upstream security fixes, such as bumping wasmtime to 24.0.10 to resolve CVE-2026-54786. Additionally, several bugs have been fixed, including issues with AWS request signing, dynamic modules, and statistics. This release affects users of the Envoy Proxy, particularly those relying on its security and stability features.
What's Changed in Envoy Proxy 1.38.7
- Upstream security fixes: wasm bumped to wasmtime 24.0.10 to resolve CVE-2026-54786
- Bug fixes: aws fixed a race condition in route-level configuration, dynamic_modules fixed a bug in per-route config destroy hook, local_ratelimit fixed a race condition in share provider manager, sds fixed a race condition in generic secret provider, stats fixed a bug in Prometheus native histogram bucket indices
Why it matters
This release is significant for users of Envoy Proxy who rely on its security and stability features, as it addresses a security vulnerability and several bugs that could impact the performance and reliability of their applications.