---
id: CVE-2025-66220
title: Envoy is a high-performance edge/middle/service proxy
summary: >-
  Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10,
  1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for
  match_typed_subject_alt_names may incorrectly treat certificates containing an
  embedded null by…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-170
vendor: envoyproxy
product: envoy
affected:
  - envoy < 1.33.13
  - 'envoy >= 1.34.0, < 1.34.11'
  - 'envoy >= 1.35.0, < 1.35.7'
  - 'envoy >= 1.36.0, < 1.36.3'
patched:
  - envoy 1.36.3
published: '2025-12-03'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66220'
references:
  - url: >-
      https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00168
epssPercentile: 0.05367
ingestedAt: '2026-09-25T23:21:16.870Z'
---

## Overview

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

## Affected

- `envoy < 1.33.13`
- `envoy >= 1.34.0, < 1.34.11`
- `envoy >= 1.35.0, < 1.35.7`
- `envoy >= 1.36.0, < 1.36.3`

## Remediation

Upgrade past the affected range:

- `envoy 1.36.3`