Workers, WAF - WAF and framework adapter mitigations for React and Next.js vulnerabilities
UpdateUnverifiedAdded Sep 24, 2026
Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.
Topics: Security, Pricing, Developer tools
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Custom DHCP options on Cloudflare One Applianceunverified Update | Update |
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Source-based breakout and prioritization on Cloudflare One Applianceunverified Update | Update |
| May 7 | Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve provisioning of Cloudflare One Virtual Appliance via APIunverified Update | Update |
| May 7 | Security Center - CSV export and adjustable page density for RFIsunverified Update | Update |
| May 7 | Stream - Introducing Stream Bindings for Workersunverified Update | Update |
| May 7 | WAF - WAF Release - 2026-05-07 - Emergencyunverified Update | Update |
| May 7 | Workers - Automatic tracing across Durable Object and Worker subrequestsunverified Update | Update |
| May 8 | Workers AI - Planned model deprecations on Workers AIunverified Deprecation | Deprecation |
Also shipped on May 7, 2026
Cloudflare in May 2026| Date | Company | Release | Product | Type |
|---|---|---|---|---|
| May 7 |  Netlify | Gemini 3.1 Flash-Lite now available in AI Gatewayunverified | Netlify | Preview |
| May 7 |  Sentry | Monitors & Alerts , Now Generally Availableunverified | Sentry | GA |
| May 7 |  MotherDuck | - Data exports from Dives: Dives can now include export buttons that deliver CSV, JSON, Parquet, or Excel...unverified | MotherDuck | Update |
| May 7 |  Notion | Plan Modeunverified | Notion | Update |
| May 7 |  Resend | Auth0 Integrationunverified | Resend | Update |
| May 7 |  Shopify | Bots and agents should identify themselves via Web Bot Authunverified | Shopify developer platform | Update |
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.