Releasesby GlyphWAF - WAF Release - 2025-12-11 - Emergency
This emergency release introduces rules for CVE-2025-55183 and CVE-2025-55184, targeting server-side function exposure and resource-exhaustion patterns, respectively. Key Findings Added coverage for Leaking Server Functions (CVE-2025-55183) and React Function DoS detection (CVE-2025-55184).
Also shipped Dec 11, 2025Cloudflare in December 2025 →
Mobile Session Replay in Public Preview
We are excited to announce the Public Preview of Mobile Session Replay. This new capability allows you to review replays for your mobile apps synced with detailed telemetry data, giving you the context needed to understand user interactions and resolve issues faster. What is Mobile Session Replay?
Private Source Map Uploads now GA
Private Source Map Upload is now Generally Available. Grafana Frontend Observability uses source maps to convert stack traces from JavaScript browser errors back into their original representations so that you can see the line of code that cause the issue.
PHI Redaction Now Available for Batch and Streaming Speech-to-Text
We're excited to announce that PHI (Protected Health Information) redaction is now available for both batch (pre-recorded) and streaming speech-to-text. redact=phi You can now redact protected health information using the new phi parameter, which redacts the following entity types: condition , drug , injury , blood_type , medical_process , and statistics .
Why ctx.db is changing, and what you should do about it
Convex version 1.31.0 updates database functions (get, patch, replace, delete) to require the table name as the first argument, improving API safety and ergonomics.
Action required: React/Next.js CVE-2025-55184 and CVE-2025-55183
Update (2025-12-12 00:41 UTC): The React and Next.js patches initially published on Dec. 11 at 21:10 incompletely addressed the vulnerabilities. A follow-up CVE was issued and follow-up patches have been released by the React and Next.js teams. All versions below have been updated accordingly.
GPT-5.2 and GPT-5.2-Pro now available in AI Gateway and Agent Runners
OpenAI's GPT-5.2 and GPT-5.2-Pro are now available through AI Gateway and Agent Runners. You can call these models from Netlify Functions without configuring API keys; the AI Gateway provides the connection to OpenAI for you.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Logs - SentinelOne as Logpush destination
Cloudflare Logpush now supports SentinelOne as a native destination. Logs from Cloudflare can be sent to SentinelOne AI SIEM ↗ via Logpush . The destination can be configured through the Logpush UI in the Cloudflare dashboard or by using the Logpush API . For more information, refer to the Destination Configuration documentation.
Durable Objects, Workers - Billing for SQLite Storage
Storage billing for SQLite-backed Durable Objects will be enabled in January 2026, with a target date of January 7, 2026 (no earlier). To view your SQLite storage usage, go to the Durable Objects page Go to Durable Objects ↗ If you do not want to incur costs, please take action such as optimizing queries or deleting unnecessary stored data in order to...
R2 SQL now supports aggregations and schema discovery
R2 SQL now supports aggregation functions, GROUP BY , HAVING , along with schema discovery commands to make it easy to explore your data catalog. Aggregation Functions You can now perform aggregations on Apache Iceberg tables in R2 Data Catalog using standard SQL functions including COUNT(*) , SUM() , AVG() , MIN() , and MAX() .
AI Crawl Control - Pay Per Crawl (Private beta) - Discovery API, custom pricing, and advanced configuration
Pay Per Crawl is introducing enhancements for both AI crawler operators and site owners, focusing on programmatic discovery, flexible pricing models, and granular configuration control. For AI crawler operators Discovery API A new authenticated API endpoint allows verified crawlers to programmatically discover domains participating in Pay Per Crawl.
WAF Release - 2025-12-10 - Emergency
This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns.
Cloudflare One Client - WARP client for Windows (version 2025.10.118.1)
A new Beta release for the Windows WARP client is now available on the beta releases downloads page . This release contains minor fixes and improvements. Changes and improvements The Local Domain Fallback feature has been fixed for devices running WARP client version 2025.4.929.0 and newer.
Cloudflare One Client - WARP client for macOS (version 2025.10.118.1)
A new Beta release for the macOS WARP client is now available on the beta releases downloads page . This release contains minor fixes and improvements. Changes and improvements The Local Domain Fallback feature has been fixed for devices running WARP client version 2025.4.929.0 and newer.
Workers - Python cold start improvements
Python Workers now feature improved cold start performance, reducing initialization time for new Worker instances. This improvement is particularly noticeable for Workers with larger dependency sets or complex initialization logic. Every time you deploy a Python Worker, a memory snapshot is captured after the top level of the Worker is executed.