Releasesby GlyphWorkers, WAF - WAF and framework adapter mitigations for React and Next.js vulnerabilities
Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.
Also shipped May 7, 2026Cloudflare in May 2026 →
Security Center 2.0: Act on vulnerabilities in bulk across all your apps
Replit updated its Security Center to allow users to view and remediate vulnerabilities across all projects in bulk. Users can now identify and fix critical CVEs on published projects from a centralized dashboard.
Consistent Web Search and Fetch Across Every Model
OpenRouter now enables tool-calling models to perform web searches and fetch page content. Users can choose from multiple search and fetch engines to integrate these capabilities into their workflows.
Prisma 8: A Call for Extension Authors
Prisma 8 features a modular core that allows developers to build and integrate extensions for specific databases, vector search, and JSON-with-schema.
Gemini 3.1 Flash-Lite now available in AI Gateway
Google’s Gemini 3.1 Flash-Lite model is now available through Netlify’s AI Gateway with zero configuration required. The Preview version of this model was available as of March 3, 2026. Use the Google GenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
Monitors & Alerts , Now Generally Available
We’ve updated how you build alerts - separated now into Monitors and Alerts - to give you more control over what you track and how your team gets notified.
- Data exports from Dives: Dives can now include export buttons that deliver CSV, JSON, Parquet, or Excel...
- Data exports from Dives: Dives can now include export buttons that deliver CSV, JSON, Parquet, or Excel files, both in the MotherDuck UI and in embedded Dives . Wire up exports from your Dive code with the new exportAs and useExport hooks from @motherduck/react-sql-query .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Custom DHCP options on Cloudflare One Appliance
When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Source-based breakout and prioritization on Cloudflare One Appliance
Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by source in addition to destination application. You can pin breakout or priority behavior to: A source LAN interface , VLANs attached to that LAN are included automatically. A source IP address, range, or CIDR block.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve provisioning of Cloudflare One Virtual Appliance via API
You can now create, rotate, and delete Cloudflare One Virtual Appliance instances and their license keys directly via the API and Terraform. Create a virtual appliance and receive a license key: POST /accounts/{account_id}/magic/connectors with device.provision_license: true .
Security Center - CSV export and adjustable page density for RFIs
You can now export your Requests for Information (RFI) history to a CSV document and customize your dashboard view by choosing how many RFI records to load per page.
Stream - Introducing Stream Bindings for Workers
You can now interact with your Stream video library using new bindings for Workers! This allows customers to upload content to Stream, provision direct uploads, manage videos, and generate signed URLs from a Worker without making authenticated API calls.
WAF Release - 2026-05-07 - Emergency
This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575). Key Findings CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes Successful exploitation allows unauthenticated attackers to bypass middleware or...
Workers - Automatic tracing across Durable Object and Worker subrequests
You can now get a single unified trace across Worker-to-Worker subrequests, with trace context propagating automatically. Previously, automatic tracing produced disconnected traces when a Worker called another Worker through a service binding or Durable Object .
Workers AI - Planned model deprecations on Workers AI
We are refreshing the Workers AI model catalog to make room for newer releases. Please update your apps to remove references to the models listed below before the deprecation date. Recommended replacements @cf/zai-org/glm-4.7-flash , fast multilingual model with multi-turn tool calling and coding capabilities.