Infrastructure
Envoy: supported versions and open vulnerabilities today
Envoy 1.40, 1.39, 1.38 and 1.37 are supported (1.37 until Jan 13, 2027); 1.36 reached end of life on Oct 14, 2026; the latest release is 1.40.0. 1 high or critical advisory for Envoy was published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 1.40.0
- GitHub stars
- 29.1k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 9.1 / 10
Supported versions
Security advisories
8 advisories published in the last 12 months, 1 of them high or critical. 11 in total since records began. Checked packages: github.com/envoyproxy/envoy.
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation
Fixed in 1.34.13, 1.35.9, 1.36.5 and 1.37.1.
EPSS: top 73%
Maintenance and supply chain
OpenSSF Scorecard 9.1 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 14 issue updates found in the last 90 days.
Weakest checks
- No branch protection (Branch-Protection 4/10)
Alternatives
Nginx
High-performance web server and reverse proxy
Strengths
- Extremely fast and lightweight
- Low resource usage
Trade-offs
- Configuration syntax can be complex
- Advanced features require Nginx Plus
HAProxy
Reliable, high-performance TCP/HTTP load balancer
Strengths
- Very high performance
- Advanced health checking
Trade-offs
- Configuration can be complex
- Less suitable for serving static content
Traefik
Modern HTTP reverse proxy and load balancer for microservices
Strengths
- Automatic service discovery
- Native Docker/Kubernetes integration
Trade-offs
- Higher resource usage than Nginx/HAProxy
- Younger project with smaller community
AWS ALB
AWS Application Load Balancer for HTTP/HTTPS traffic
Strengths
- Fully managed by AWS
- Native AWS service integration
Trade-offs
- AWS vendor lock-in
- Limited customization
Docs and release notes
Check Envoy in your own stack
This page checks Envoy in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.