# Envoy v1.38.6 releases security fixes for oauth2 and api_key_auth

> **Key takeaway:** Envoy v1.38.6 addresses two security vulnerabilities that could cause crashes during CONNECT requests.

**Published:** 2026-10-06T18:54:05+00:00 
**Source:** Envoy Cloud-Native Edge Proxy 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/envoy-v1386-releases-security-fixes-for-oauth2-and-apikeyaut.html 

## Summary
The Envoy proxy has released version 1.38.6 to address two specific security vulnerabilities. These fixes prevent service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

## Security vulnerability details
- **GHSA-8vc2-jrm4-835w**: Fixed a crash in the **oauth2** filter when processing requests without a **:path** header (e.g., **CONNECT** requests); these are now rejected with a **400** error.
- **GHSA-47vj-9r25-wv5j**: Fixed a crash in **api_key_auth** occurring when **hide_credentials** is enabled with a query key source and a request without a **:path** header is authenticated via a different key source.