WAF - WAF Release - 2025-12-02 - Emergency
UpdateUnverifiedAdded Sep 24, 2026
This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns.
Topics: Security
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| Dec 3 | Email security - Reclassifications to Submissionsunverified Update | Update |
| Dec 3 | WAF - WAF Release - 2025-12-03 - Emergencyunverified Update | Update |
| Dec 1 | WAF - WAF Release - 2025-12-01unverified Update | Update |
| Dec 4 | Hyperdrive - Connect to remote databases during local development with wrangler devunverified Update | Update |
| Dec 4 | Workers - One-click Access protection for Workers now creates reusable Cloudflare Access policiesunverified Preview | Preview |
| Dec 5 | Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now availableunverified Update | Update |
| Dec 5 | WAF - Increased WAF payload limit for all plansunverified Update | Update |
| Dec 5 | WAF - Updating the WAF maximum payload valuesunverified Update | Update |
Also shipped on Dec 2, 2025
Cloudflare in December 2025| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| Dec 2 |  Shopify | InventoryItem.variant field deprecated in favor of InventoryItem.variants connectionunverified | Shopify developer platform | Deprecation |
| Dec 2 |  Bun | Bun is joining Anthropicunverified | Bun | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.