Envoy Gateway 1.9.1 Released, Addresses Security Vulnerability and Upgrade Issues

Envoy Gateway 1.9.1 Released

Envoy Gateway released version 1.9.1 on August 28. This maintenance release focuses on security, upgrade reliability, and operational correctness. It reverses a change made in version 1.9.0 regarding secret and endpoint fetching, includes fixes for several security issues, and adds more granular observability into Gateway API and xDS translation.

Addressing Upgrade Path Difficulties

A significant change in 1.9.1 involves the initial fetch timeout for Secret Discovery Service (SDS) and Route Discovery Service (RDS). Version 1.9.0 had set this timeout to zero, which could cause clusters to remain in a warming state indefinitely if a Secret or endpoint was missing. This prevented CDS updates and delayed health checks. Version 1.9.1 restores the default 15-second timeout, returning to the behavior of v1.8.x.

Upgrading from 1.9.0 is complex. Changing the SDS configuration during a controller upgrade can cause an Envoy issue where TLS listeners become active without certificates, leading to failed TLS handshakes. Backend TLS configurations and global rate-limit services can experience similar problems. A GitHub issue described an outage where long-running Envoy proxies lost downstream TLS certificates and stopped serving HTTPS traffic, requiring manual restarts.

Upgrade Recommendations

For users on v1.8.x, the project recommends upgrading directly to v1.9.1, skipping v1.9.0. Existing v1.9.0 deployments require a rolling-update configuration to replace proxy pods quickly. This method requires sufficient cluster capacity and can interrupt existing connections, particularly long-lived WebSocket and gRPC connections.

Security Enhancements

Security is a key focus of this release. Envoy Gateway now enables AES-256-GCM for OAuth2/OIDC session-cookie encryption. It also removes support for the legacy AES-256-CBC decryption path, which addresses the padding-oracle vulnerability identified as CVE-2026-47775.