# Envoy v1.36.13 releases with security fix for Wasmtime

> **Key takeaway:** Envoy v1.36.13 addresses CVE-2026-54786 by upgrading the Wasmtime dependency.

**Published:** 2026-10-12T19:20:35+00:00 
**Source:** Envoy Cloud-Native Edge Proxy 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/envoy-v13613-releases-with-security-fix-for-wasmtime.html 

## Summary
The Envoy proxy team has released version 1.36.13, which includes a critical security update for WebAssembly support. The release also resolves several race conditions affecting AWS filters, local rate limiting, and Secret Discovery Service (SDS) configurations.

## Technical changes in Envoy v1.36.13
- **Security**: Upgraded **Wasmtime** to version 24.0.10 to resolve **CVE-2026-54786**.
- **AWS**: Fixed a race condition where AWS request signing and AWS Lambda filter configurations could be destroyed on a worker thread during an RDS update.
- **Local Rate Limit**: Resolved a race condition involving the destruction of the share provider manager on a worker thread.
- **SDS**: Fixed a race condition where a generic secret provider shared with worker threads could be destroyed prematurely.

## Why it matters
Users running Envoy with WebAssembly extensions or AWS-specific filters should upgrade to avoid potential security vulnerabilities and stability issues caused by race conditions.