# Envoy releases v1.37.8 to fix security crashes

> **Key takeaway:** Envoy v1.37.8 addresses two security vulnerabilities that could cause crashes during CONNECT requests.

**Published:** 2026-10-06T18:53:17+00:00 
**Source:** Envoy Cloud-Native Edge Proxy 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/envoy-releases-v1378-to-fix-security-crashes.html 

## Summary
Envoy has released version 1.37.8 to address two security vulnerabilities related to request handling. The update fixes crashes in the oauth2 and api_key_auth filters when processing requests lacking a :path header, such as CONNECT requests.

## Security fixes in Envoy v1.37.8
- **GHSA-8vc2-jrm4-835w**: Fixes an oauth2 filter crash occurring on requests without a :path header (e.g., CONNECT); these requests are now rejected with a 400 error.
- **GHSA-47vj-9r25-wv5j**: Fixes an api_key_auth crash when hide_credentials is enabled with a query key source and a request without a :path header is authenticated via a different key source.