WAF - WAF Release - 2026-05-07 - Emergency
UpdateUnverifiedAdded Sep 24, 2026
This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575). Key Findings CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes Successful exploitation allows unauthenticated attackers to bypass middleware or...
Topics: Security
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| May 7 | Workers, WAF - WAF and framework adapter mitigations for React and Next.js vulnerabilitiesunverified Update | Update |
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Custom DHCP options on Cloudflare One Applianceunverified Update | Update |
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Source-based breakout and prioritization on Cloudflare One Applianceunverified Update | Update |
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve provisioning of Cloudflare One Virtual Appliance via APIunverified Update | Update |
| May 7 | Security Center - CSV export and adjustable page density for RFIsunverified Update | Update |
| May 7 | Stream - Introducing Stream Bindings for Workersunverified Update | Update |
| May 7 | Workers - Automatic tracing across Durable Object and Worker subrequestsunverified Update | Update |
| May 8 | Workers AI - Planned model deprecations on Workers AIunverified Deprecation | Deprecation |
Also shipped on May 7, 2026
Cloudflare in May 2026| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| May 7 |  Netlify | Gemini 3.1 Flash-Lite now available in AI Gatewayunverified | Netlify | Preview |
| May 7 |  Sentry | Monitors & Alerts , Now Generally Availableunverified | Sentry | GA |
| May 7 |  MotherDuck | - Data exports from Dives: Dives can now include export buttons that deliver CSV, JSON, Parquet, or Excel...unverified | MotherDuck | Update |
| May 7 |  Notion | Plan Modeunverified | Notion | Update |
| May 7 |  Resend | Auth0 Integrationunverified | Resend | Update |
| May 7 |  Shopify | Bots and agents should identify themselves via Web Bot Authunverified | Shopify developer platform | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.