FOSSWire
cloud-native

Envoy v1.36.13 releases with security fix for Wasmtime

Brief written by the FOSSWire AI editor from Envoy Cloud-Native Edge Proxy

1 min read Impact: 6/10

Key Takeaway

Envoy v1.36.13 addresses CVE-2026-54786 by upgrading the Wasmtime dependency.

Summary

The Envoy proxy team has released version 1.36.13, which includes a critical security update for WebAssembly support. The release also resolves several race conditions affecting AWS filters, local rate limiting, and Secret Discovery Service (SDS) configurations.

Technical changes in Envoy v1.36.13

  • Security: Upgraded Wasmtime to version 24.0.10 to resolve CVE-2026-54786.
  • AWS: Fixed a race condition where AWS request signing and AWS Lambda filter configurations could be destroyed on a worker thread during an RDS update.
  • Local Rate Limit: Resolved a race condition involving the destruction of the share provider manager on a worker thread.
  • SDS: Fixed a race condition where a generic secret provider shared with worker threads could be destroyed prematurely.

Why it matters

Users running Envoy with WebAssembly extensions or AWS-specific filters should upgrade to avoid potential security vulnerabilities and stability issues caused by race conditions.

Original reference: github.com →