v1.40.0

2026-10-14T08:52:16Z•b25c4a4218b77b1d4bda8218c02e799f83a47efe557d3ce085f35b1ed0d5c5f6

CVE-2026-54786BazelEnvoyTLSWasmWasmtimeapi_key_authbzlmoddenial-of-servicedynamic-modulesoauth2proxyrace-conditionrequest-crashservice-mesh

Open source link →

What happened

Envoy releases v1.36.13 through v1.40.0 include security fixes for request-triggered crashes in the oauth2 and api_key_auth filters, a Wasmtime upgrade addressing CVE-2026-54786, and multiple concurrency and configuration-lifetime race fixes. The v1.40.0 release also introduces breaking Bazel/bzlmod, toolchain, Wasm engine, TLS, MCP header-forwarding, and Rust dynamic-module changes.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: envoyproxy_envoy_releases
Record identifier: b25c4a4218b77b1d4bda8218c02e799f83a47efe557d3ce085f35b1ed0d5c5f6
Enrichment time: 2026-10-14T08:52:16Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records