v1.38.1

Official Envoy changelog summary with source attribution, release tags, and community reactions.

Track this Envoy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Envoy·3 months ago · Jun 4, 2026, 07:28 PMFixSecurity-relevantAI-assisted summary

Summary

HTTP/2 security updates: streams reset on header size violations, cookies count toward header limits, and nghttp2 CVE‑2026‑27135 patch applied.
OAuth2 fixes: mitigated a timing side‑channel in HMAC verification and resolved a crash in AES‑CBC token cookie decryption.
Minor bugfixes/behavior changes: fixed a crash in dynamic module filter construction, hid upstream transport failure reason from response bodies, and made load‑balancer rebuild coalescing opt‑in.

securitybugfixminorsource healthy

Official source Last checked 14 hours ago

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 14 hours ago

related channels

Turn this Envoy release note into a weekly digest for the tools you actually use.