Infrastructure
Istio: supported versions and open vulnerabilities today
Istio 1.31 and 1.30 are supported (1.31 until Feb 28, 2027); 1.29 reached end of life on Oct 15, 2026; the latest release is 1.31.2. No high or critical advisories for Istio were published in the last 12 months (2 lower-severity); none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV and deps.dev.
- Latest release
- 1.31.2
- GitHub stars
- 38.4k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 6.3 / 10
Supported versions
Security advisories
2 advisories published in the last 12 months. 10 in total since records began. Checked packages: istio.io/istio.
Maintenance and supply chain
OpenSSF Scorecard 6.3 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 6 issue updates found in the last 90 days.
Weakest checks
- Unsigned releases (Signed-Releases 0/10)
- No static analysis (SAST 0/10)
- Unpinned build dependencies (Pinned-Dependencies 1/10)
Alternatives
Linkerd
Lightweight service mesh for Kubernetes
Strengths
- Simpler than Istio
- Lower resource usage
Trade-offs
- Kubernetes-only
- Fewer features than Istio
Consul Connect
Service mesh built into HashiCorp Consul
Strengths
- Integrates with HashiCorp ecosystem (Vault, Nomad)
- Multi-platform support (Kubernetes, VMs, serverless)
Trade-offs
- Less feature-rich than Istio for advanced scenarios
- Smaller community compared to Istio/Linkerd
Kuma
Universal service mesh built on Envoy
Strengths
- Platform-agnostic (Kubernetes, VMs, multi-cloud)
- Built on proven Envoy proxy
Trade-offs
- Younger project with smaller community
- Less battle-tested than Istio
AWS App Mesh
AWS-managed service mesh built on Envoy
Strengths
- Fully managed by AWS (no control plane management)
- Deep integration with AWS services (ECS, EKS, Fargate)
Trade-offs
- AWS vendor lock-in
- Limited to AWS ecosystem
Docs and release notes
Check Istio in your own stack
This page checks Istio in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.