Releasesby GlyphAction required: React/Next.js CVE-2025-55184 and CVE-2025-55183
Update (2025-12-12 00:41 UTC): The React and Next.js patches initially published on Dec. 11 at 21:10 incompletely addressed the vulnerabilities. A follow-up CVE was issued and follow-up patches have been released by the React and Next.js teams. All versions below have been updated accordingly.
Also shipped Dec 11, 2025Netlify in December 2025 →
Mobile Session Replay in Public Preview
We are excited to announce the Public Preview of Mobile Session Replay. This new capability allows you to review replays for your mobile apps synced with detailed telemetry data, giving you the context needed to understand user interactions and resolve issues faster. What is Mobile Session Replay?
Private Source Map Uploads now GA
Private Source Map Upload is now Generally Available. Grafana Frontend Observability uses source maps to convert stack traces from JavaScript browser errors back into their original representations so that you can see the line of code that cause the issue.
PHI Redaction Now Available for Batch and Streaming Speech-to-Text
We're excited to announce that PHI (Protected Health Information) redaction is now available for both batch (pre-recorded) and streaming speech-to-text. redact=phi You can now redact protected health information using the new phi parameter, which redacts the following entity types: condition , drug , injury , blood_type , medical_process , and statistics .
Why ctx.db is changing, and what you should do about it
Convex version 1.31.0 updates database functions (get, patch, replace, delete) to require the table name as the first argument, improving API safety and ergonomics.
Logs - SentinelOne as Logpush destination
Cloudflare Logpush now supports SentinelOne as a native destination. Logs from Cloudflare can be sent to SentinelOne AI SIEM ↗ via Logpush . The destination can be configured through the Logpush UI in the Cloudflare dashboard or by using the Logpush API . For more information, refer to the Destination Configuration documentation.
WAF Release - 2025-12-11 - Emergency
This emergency release introduces rules for CVE-2025-55183 and CVE-2025-55184, targeting server-side function exposure and resource-exhaustion patterns, respectively. Key Findings Added coverage for Leaking Server Functions (CVE-2025-55183) and React Function DoS detection (CVE-2025-55184).
More from NetlifyEvery Netlify release →
GPT-5.2 and GPT-5.2-Pro now available in AI Gateway and Agent Runners
OpenAI's GPT-5.2 and GPT-5.2-Pro are now available through AI Gateway and Agent Runners. You can call these models from Netlify Functions without configuring API keys; the AI Gateway provides the connection to OpenAI for you.
AI Gateway now Generally Available
AI Gateway is now generally available (GA) for all Netlify users. Build AI-powered apps with confidence using our fully managed gateway that handles AI model keys, setup, and monitoring automatically. For a deeper dive into AI Gateway capabilities, check out our latest blog post.
Observability is here
Netlify Observability offers real-time visibility into your project's production performance and resource usage. Monitor requests, bandwidth, runtime behavior, functions, and Edge Functions to understand how your web project operates in production, fix errors, and optimize web performance. Get a deep feature tour from our Observability blog post.
New Prerender extension
The Prerender extension is now generally available (GA) for all Netlify users. The legacy prerendering feature is now deprecated with limited support. Once set up, this extension automatically serves pre-rendered HTML to crawlers, agents, and preview services, while regular site visitors continue to receive your standard JavaScript application.
Gemini 3 Flash Preview now available in AI Gateway
Google’s Gemini 3 Flash Preview is now available through AI Gateway. You can call this model from Netlify Functions without configuring API keys; the AI Gateway provides the connection to Google for you.
GPT-image-1.5 now available in AI Gateway
OpenAI's GPT-image-1.5 is now available through AI Gateway. You can call this model from Netlify Functions without configuring API keys; the AI Gateway provides the connection to OpenAI for you.
GPT-5.1-Codex-Max now available in AI Gateway and Agent Runners
OpenAI's GPT-5.1-Codex-Max model is now available through Netlify's AI Gateway and Agent Runners with zero configuration required. Use the OpenAI SDK directly in your Netlify Functions without managing API keys or authentication. The AI Gateway handles everything automatically.
Netlify’s response to the critical React & Next.js security vulnerability
Update (2025-12-08 22:45 UTC): Sites that have not yet upgraded to a patched version of Next.js (or other affected framework) must upgrade immediately. Following upgrade, we also recommend rotating all credentials that are scoped for access within Netlify Functions, if you have been running a vulnerable version on or after December 4th, 2025 at 1:00 PM PT.