Releasesby GlyphWAF - WAF Release - 2025-12-02 - Emergency
This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns.
Also shipped Dec 2, 2025Cloudflare in December 2025 →
Introducing Analytics Buckets
Analytics Buckets provide a storage layer for large datasets using Apache Iceberg and Parquet formats, optimized for analytical workloads.
Introducing Supabase Pipelines
Supabase Pipelines provides managed change-data-capture to replicate Postgres tables to analytical destinations like BigQuery in near real-time.
Introducing Components Authoring
The components authoring guide is now available, allowing developers to build and publish their own Convex components. Three new components were also released.
InventoryItem.variant field deprecated in favor of InventoryItem.variants connection
The InventoryItem.variant field has been deprecated and will be removed in a future API version. Use the new InventoryItem.variants connection instead. To learn more, see InventoryItem object or inventoryItem query in the GraphQL Admin API reference.
Release of Mistral Large 3 and Ministral 3
Mistral Large 3 (mistral-large-2512) and Ministral 3 (ministral-3b-2512, ministral-8b-2512, and ministral-14b-2512) have been released.
Bun is joining Anthropic
Bun has been acquired by Anthropic. Anthropic is betting on Bun as the infrastructure powering Claude Code, Claude Agent SDK, and future AI coding products & tools.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Email security - Reclassifications to Submissions
We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns.
WAF Release - 2025-12-03 - Emergency
The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.
WAF Release - 2025-12-01
This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage.
Hyperdrive - Connect to remote databases during local development with wrangler dev
You can now connect directly to remote databases and databases requiring TLS with wrangler dev . This lets you run your Worker code locally while connecting to remote databases, without needing to use wrangler dev --remote .
Workers - One-click Access protection for Workers now creates reusable Cloudflare Access policies
Workers applications now use reusable Cloudflare Access policies to reduce duplication and simplify access management across multiple Workers. Previously, enabling Cloudflare Access on a Worker created per-application policies, unique to each application.
Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available
Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release.
WAF - Increased WAF payload limit for all plans
Cloudflare WAF now inspects request-payload size of up to 1 MB across all plans to enhance our detection capabilities for React RCE (CVE-2025-55182). Key Findings React payloads commonly have a default maximum size of 1 MB. Cloudflare WAF previously inspected up to 128 KB on Enterprise plans, with even lower limits on other plans.
WAF - Updating the WAF maximum payload values
We are reinstating the maximum request-payload size the Cloudflare WAF inspects, with WAF on Enterprise zones inspecting up to 128 KB. Key Findings On December 5, 2025 , we initially attempted to increase the maximum WAF payload limit to 1 MB across all plans.