Releasesby GlyphWAF - WAF Release - 2025-12-01
This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage.
Also shipped Dec 1, 2025Cloudflare in December 2025 →
Introducing Vector Buckets
Vector Buckets provide a durable storage layer for Supabase with built-in similarity search capabilities.
Grok Speech to Speech API is released
Grok Speech to Speech API is generally available. Visit Grok Speech to Speech API for guidance on using the API.
Restore deleted dashboards
If you’d like to try it out in our private preview, you can sign up here . And we would love your feedback, you can share it here . You can now restore dashboards you’ve deleted, no support ticket needed. With the new Recently deleted view, accidentally removing a dashboard no longer means lost work or rebuilding panels from scratch.
Netlify Vite Plugin now supports AI Gateway locally
You can now use AI Gateway in local development with just npm run dev when using the Netlify Vite Plugin. Previously, AI Gateway's auto-configured environment variables only worked when running netlify dev, which added friction for developers using Vite-powered frameworks like Astro.
UI Profiling support for Browser JavaScript and Electron
UI Profiling is now supported in the Sentry Browser JavaScript and Electron SDKs
Send Logs to Sentry via the OpenTelemetry Collector, Vector, or Fluent Bit
You can now forward logs from the OpenTelemetry Collector, Vector, or Fluent Bit to Sentry
More from Cloudflare developer platformEvery Cloudflare developer platform release →
WAF Release - 2025-12-02 - Emergency
This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns.
Email security - Reclassifications to Submissions
We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns.
WAF Release - 2025-12-03 - Emergency
The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.
Hyperdrive - Connect to remote databases during local development with wrangler dev
You can now connect directly to remote databases and databases requiring TLS with wrangler dev . This lets you run your Worker code locally while connecting to remote databases, without needing to use wrangler dev --remote .
Workers - One-click Access protection for Workers now creates reusable Cloudflare Access policies
Workers applications now use reusable Cloudflare Access policies to reduce duplication and simplify access management across multiple Workers. Previously, enabling Cloudflare Access on a Worker created per-application policies, unique to each application.
Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available
Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release.
WAF - Increased WAF payload limit for all plans
Cloudflare WAF now inspects request-payload size of up to 1 MB across all plans to enhance our detection capabilities for React RCE (CVE-2025-55182). Key Findings React payloads commonly have a default maximum size of 1 MB. Cloudflare WAF previously inspected up to 128 KB on Enterprise plans, with even lower limits on other plans.
WAF - Updating the WAF maximum payload values
We are reinstating the maximum request-payload size the Cloudflare WAF inspects, with WAF on Enterprise zones inspecting up to 128 KB. Key Findings On December 5, 2025 , we initially attempted to increase the maximum WAF payload limit to 1 MB across all plans.