1.37.8 (October 6, 2026)

Bug fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

• api_key_auth: Fix: GHSA-47vj-9r25-wv5j

  Fixed a crash in the api_key_auth HTTP filter when hide_credentials is enabled with a query parameter key source and a request without a :path header (for example a CONNECT request) is authenticated via another key source. The filter now skips query-string rewriting when there is no :path.

• oauth2: Fix: GHSA-8vc2-jrm4-835w

  Fixed a crash in the oauth2 HTTP filter when a request without a :path header (for example a plain CONNECT tunnel request) reached the filter. The filter now rejects a request that has no :path with a 400 (Bad Request) local reply.