# Envoy v1.39.3 releases security fixes for oauth2 and api_key_auth crashes

> **Key takeaway:** Envoy v1.39.3 addresses two security vulnerabilities that could cause service crashes during specific CONNECT requests.

**Published:** 2026-10-06T18:55:07+00:00 
**Source:** Envoy Cloud-Native Edge Proxy 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/envoy-v1393-releases-security-fixes-for-oauth2-and-apikeyaut.html 

## Summary
The Envoy proxy team has released version 1.39.3 to address two security vulnerabilities. These issues involve service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

## Security vulnerability details
- **GHSA-8vc2-jrm4-835w**: The oauth2 filter previously crashed on requests without a :path header (e.g., CONNECT). It now rejects these requests with a 400 error.
- **GHSA-47vj-9r25-wv5j**: The api_key_auth filter could crash when `hide_credentials` was enabled with a query key source if a request without a :path header was authenticated via a different key source.