WAF - WAF Release - 2025-11-05 - Emergency
UpdateUnverifiedAdded Sep 24, 2026
This week’s emergency release introduces a new detection signature that enhances coverage for a critical vulnerability in the React Native Metro Development Server, tracked as CVE-2025-11953. Key Findings The Metro Development Server exposes an HTTP endpoint that is vulnerable to OS command injection (CWE-78).
Topics: AI agents, Security, Developer tools
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| Nov 5 | D1, Workers - D1 can restrict data localization with jurisdictionsunverified Update | Update |
| Nov 5 | Logs - Logpush Permission Update for Zero Trust Datasetsunverified Update | Update |
| Nov 5 | Workers VPC - Announcing Workers VPC Services (Beta)unverified Beta | Beta |
| Nov 6 | Cloudflare One, Cloudflare WAN - Automatic Return Routing (Beta)unverified Beta | Beta |
| Nov 6 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Designate WAN link for breakout trafficunverified Update | Update |
| Nov 6 | Gateway - Applications to be remapped to the new categoriesunverified Update | Update |
| Nov 4 | Log Explorer - Log Explorer now supports query cancellationunverified Update | Update |
| Nov 4 | Log Explorer - Log Explorer now shows query result distributionunverified Update | Update |
Also shipped on Nov 5, 2025
Cloudflare in November 2025| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| Nov 5 |  Cerebras | Deprecated qwen-3-coder-480bunverified | Cerebras Inference | Deprecation |
| Nov 5 |  Deepgram | Legacy Intelligence Features Deprecatedunverified | Deepgram | Deprecation |
| Nov 5 |  New Relic | New Relic MCP Server Launches into Public Previewunverified | New Relic | Preview |
| Nov 5 | New Relic | New Relic Outlier Detection in public previewunverified | New Relic | Preview |
| Nov 5 | Deepgram | What's Changedunverified | Deepgram | Update |
| Nov 5 | Deepgram | Documentation Resourcesunverified | Deepgram | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.