Releasesby GlyphWorkers - One-click Access protection for Workers now creates reusable Cloudflare Access policies
Workers applications now use reusable Cloudflare Access policies to reduce duplication and simplify access management across multiple Workers. Previously, enabling Cloudflare Access on a Worker created per-application policies, unique to each application.
Also shipped Dec 4, 2025Cloudflare in December 2025 →
Adding Async Streaming to Postgres Foreign Data Wrappers
Supabase Wrappers now supports asynchronous streaming for Postgres Foreign Data Wrappers, improving performance for large analytical workloads.
Build "Sign in with Your App" using Supabase Auth
Supabase Auth now functions as an identity provider, supporting OAuth 2.1 and OpenID Connect to enable SSO for AI agents and third-party applications.
Critical Security Vulnerability in React Server Components
A critical security vulnerability was identified in React Server Components affecting specific versions of react-server-dom and Next.js.
Introducing the Batch API: Simpler and more efficient for large-scale workloads
The new Batch API is an asynchronous endpoint for processing large volumes of requests. It offers higher throughput, a 12-hour completion window, and 33% cost savings compared to synchronous alternatives.
- Transient storage filter in Settings: The Databases page in Settings in the MotherDuck UI now supports...
- Transient storage filter in Settings: The Databases page in Settings in the MotherDuck UI now supports filtering by storage type DESCRIBE and SUMMARIZE exports: Downloading the results of DESCRIBE and SUMMARIZE queries is now supported in the MotherDuck UI DuckLake option in the Add Database menu: MotherDuck users can create a new DuckLake in the 'Add...
GPT-5.1-Codex-Max now available in AI Gateway and Agent Runners
OpenAI's GPT-5.1-Codex-Max model is now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Hyperdrive - Connect to remote databases during local development with wrangler dev
You can now connect directly to remote databases and databases requiring TLS with wrangler dev . This lets you run your Worker code locally while connecting to remote databases, without needing to use wrangler dev --remote .
Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available
Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release.
WAF - Increased WAF payload limit for all plans
Cloudflare WAF now inspects request-payload size of up to 1 MB across all plans to enhance our detection capabilities for React RCE (CVE-2025-55182). Key Findings React payloads commonly have a default maximum size of 1 MB. Cloudflare WAF previously inspected up to 128 KB on Enterprise plans, with even lower limits on other plans.
WAF - Updating the WAF maximum payload values
We are reinstating the maximum request-payload size the Cloudflare WAF inspects, with WAF on Enterprise zones inspecting up to 128 KB. Key Findings On December 5, 2025 , we initially attempted to increase the maximum WAF payload limit to 1 MB across all plans.
Email security - Reclassifications to Submissions
We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns.
WAF Release - 2025-12-03 - Emergency
The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.
WAF Release - 2025-12-02 - Emergency
This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns.
WAF Release - 2025-12-01
This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage.