Envoy: Cloud-native high-performance service proxy
Cloud-native edge and service proxy with advanced load balancing, observability, and security features.
Learn more about Envoy
Envoy is a Layer 7 proxy and communication bus built for large modern service-oriented architectures. It operates as a sidecar proxy alongside application services, handling network communication with features like load balancing, service discovery, health checking, and traffic management. The proxy is implemented in C++ and designed for high throughput and low latency in production environments. Envoy is commonly used in service mesh architectures, API gateways, and as an edge proxy for microservices deployments.
Dynamic Configuration
Supports runtime configuration updates through APIs without requiring restarts. Configuration changes can be applied dynamically while maintaining active connections.
Advanced Observability
Provides detailed metrics, distributed tracing, and access logging out of the box. Includes built-in support for various observability backends and protocols.
Hot Restart
Allows binary updates and configuration changes without dropping connections. New processes can take over from old ones seamlessly during updates.
Major dynamic modules expansion with new filter types, HTTP/2 performance optimizations, and container-aware CPU detection.
- –Added support for network, listener, UDP listener, and access logger filters
- –Introduced streaming HTTP callouts to HTTP filters
- –Enhanced ABI for streaming body manipulation and header operations
- –Added global module loading and improved module search path handling
- –Container-aware CPU detection for improved resource utilization in containerized environments
Resolves dependency CVEs including c-ares security updates.
- –Security updates
- –c-ares/CVE-2025-0913
Critical security fixes for JWT authentication crashes, TLS certificate matching, and request smuggling.
- –CVE-2025-64527: Envoy crashes when JWT authentication is configured with the remote JWKS fetching
- –CVE-2025-66220: TLS certificate matcher may incorrectly treat certificates containing an embedded null byte
- –CVE-2025-64763: Potential request smuggling from early data after the CONNECT upgrade
Top in Networking
Related Repositories
Discover similar tools and frameworks used by developers
Jitsi Meet
WebRTC video conferencing with self-hosting and embeddable SDKs.
MyIP
Web app for IP detection, geolocation lookup, DNS leak testing, WebRTC analysis, and network diagnostics.
v2rayN
GUI proxy client for Windows, Linux, and macOS supporting Xray, sing-box, and other protocol implementations.
LibreSpeed
Measure bandwidth, latency, and packet loss via Cloudflare's edge network.
SwitchyOmega
Browser extension for managing and switching between multiple proxy configurations.