Cloudflare Release Notes

Hyperdrive now supports connecting to MySQL and MySQL-compatible databases, including Amazon RDS and Aurora MySQL, Google Cloud SQL for MySQL, Azure Database for MySQL, PlanetScale and MariaDB.

Hyperdrive makes your regional, MySQL databases fast when connecting from Cloudflare Workers. It eliminates unnecessary network roundtrips during connection setup, pools database connections globally, and can cache query results to provide the fastest possible response times.

Best of all, you can connect using your existing drivers, ORMs, and query builders with Hyperdrive's secure credentials, no code changes required.

import { createConnection } from "mysql2/promise";

export interface Env {
	HYPERDRIVE: Hyperdrive;
}

export default {
	async fetch(request, env, ctx): Promise<Response> {
		const connection = await createConnection({
			host: env.HYPERDRIVE.host,
			user: env.HYPERDRIVE.user,
			password: env.HYPERDRIVE.password,
			database: env.HYPERDRIVE.database,
			port: env.HYPERDRIVE.port,
			disableEval: true, // Required for Workers compatibility
		});

		const [results, fields] = await connection.query("SHOW tables;");

		ctx.waitUntil(connection.end());

		return new Response(JSON.stringify({ results, fields }), {
			headers: {
				"Content-Type": "application/json",
				"Access-Control-Allow-Origin": "*",
			},
		});
	},
} satisfies ExportedHandler<Env>;
``` …

You can now add a Deploy to Cloudflare button to the README of your Git repository containing a Workers application — making it simple for other developers to quickly set up and deploy your project!

Deploy to Cloudflare

The Deploy to Cloudflare button:

1. Creates a new Git repository on your GitHub/ GitLab account: Cloudflare will automatically clone and create a new repository on your account, so you can continue developing.
2. Automatically provisions resources the app needs: If your repository requires Cloudflare primitives like a Workers KV namespace, a D1 database, or an R2 bucket, Cloudflare will automatically provision them on your account and bind them to your Worker upon deployment.
3. Configures Workers Builds (CI/CD): Every new push to your production branch on your newly created repository will automatically build and deploy courtesy of Workers Builds. …

Full-stack on Cloudflare Workers

The following full-stack frameworks now have Generally Available ("GA") adapters for Cloudflare Workers, and are ready for you to use in production:

• React Router v7 (Remix)
• Astro
• Hono
• Vue.js
• Nuxt
• Svelte (SvelteKit)
• And more.

The following frameworks are now in beta, with GA support coming very soon:

• Next.js, supported through @opennextjs/cloudflare ↗︎ is now v1.0-beta.
• Angular …

When using a Worker with the nodejs_compat compatibility flag enabled, the following Node.js APIs are now available:

• node:crypto
• node:tls

This make it easier to reuse existing Node.js code in Workers or use npm packages that depend on these APIs.

node:crypto

The full node:crypto ↗︎ API is now available in Workers.

You can use it to verify and sign data:

import { sign, verify } from "node:crypto";

const signature = sign("sha256", "-data to sign-", env.PRIVATE_KEY);
const verified = verify("sha256", "-data to sign-", env.PUBLIC_KEY, signature);

Or, to encrypt and decrypt data:

import { publicEncrypt, privateDecrypt } from "node:crypto";

const encrypted = publicEncrypt(env.PUBLIC_KEY, "some data");
const plaintext = privateDecrypt(env.PRIVATE_KEY, encrypted);

See the node:crypto documentation for more information.

node:tls

The following APIs from node:tls are now available:

• connect ↗︎
• TLSSocket ↗︎ …

The Cloudflare Vite plugin has reached v1.0 ↗︎ and is now Generally Available ("GA").

When you use @cloudflare/vite-plugin, you can use Vite's local development server and build tooling, while ensuring that while developing, your code runs in workerd ↗︎, the open-source Workers runtime.

This lets you get the best of both worlds for a full-stack app — you can use Hot Module Replacement ↗︎ from Vite right alongside Durable Objects and other runtime APIs and bindings that are unique to Cloudflare Workers.

@cloudflare/vite-plugin is made possible by the new environment API ↗︎ in Vite, and was built in partnership with the Vite team ↗︎.

Framework support

You can build any type of application with @cloudflare/vite-plugin, using any rendering mode, from single page applications (SPA) and static sites to server-side rendered (SSR) pages and API routes. …

The Agents SDK now includes built-in support for building remote MCP (Model Context Protocol) servers directly as part of your Agent. This allows you to easily create and manage MCP servers, without the need for additional infrastructure or configuration.

The SDK includes a new MCPAgent class that extends the Agent class and allows you to expose resources and tools over the MCP protocol, as well as authorization and authentication to enable remote MCP servers.

export class MyMCP extends McpAgent {
	server = new McpServer({
		name: "Demo",
		version: "1.0.0",
	});

	async init() {
		this.server.resource(`counter`, `mcp://resource/counter`, (uri) => {
			// ...
		});

		this.server.tool(
			"add",
			"Add two numbers together",
			{ a: z.number(), b: z.number() },
			async ({ a, b }) => {
				// ...
			},
		);
	}
}

export class MyMCP extends McpAgent<Env> {
	server = new McpServer({
		name: "Demo",
		version: "1.0.0",
	});

	async init() {
		this.server.resource(`counter`, `mcp://resource/counter`, (uri) => {
			// ...
		});

		this.server.tool(
			"add",
			"Add two numbers together",
			{ a: z.number(), b: z.number() },
			async ({ a, b }) => {
				// ...
			},
		);
	}
}
``` …

AutoRAG is now in open beta, making it easy for you to build fully-managed retrieval-augmented generation (RAG) pipelines without managing infrastructure. Just upload your docs to R2, and AutoRAG handles the rest: embeddings, indexing, retrieval, and response generation via API.

With AutoRAG, you can:

• Customize your pipeline: Choose from Workers AI models, configure chunking strategies, edit system prompts, and more.
• Instant setup: AutoRAG provisions everything you need from Vectorize, AI gateway, to pipeline logic for you, so you can go from zero to a working RAG pipeline in seconds.
• Keep your index fresh: AutoRAG continuously syncs your index with your data source to ensure responses stay accurate and up to date.
• Ask questions: Query your data and receive grounded responses via a Workers binding or API.

Whether you're building internal tools, AI-powered search, or a support assistant, AutoRAG gets you from idea to deployment in minutes. …

We’re excited to announce Browser Rendering is now available on the Workers Free plan ↗︎, making it even easier to prototype and experiment with web search and headless browser use-cases when building applications on Workers.

The Browser Rendering REST API is now Generally Available, allowing you to control browser instances from outside of Workers applications. We've added three new endpoints to help automate more browser tasks:

• Extract structured data – Use /json to retrieve structured data from a webpage.
• Retrieve links – Use /links to pull all links from a webpage.
• Convert to Markdown – Use /markdown to convert webpage content into Markdown format.

For example, to fetch the Markdown representation of a webpage:

Markdown examplebash

curl -X 'POST' 'https://api.cloudflare.com/client/v4/accounts/<accountId>/browser-rendering/markdown' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <apiToken>' \
  -d '{
    "url": "https://example.com"
  }'

For the full list of endpoints, check out our REST API documentation. You can also interact with Browser Rendering via the Cloudflare TypeScript SDK ↗︎. …

Durable Objects can now be used with zero commitment on the Workers Free plan allowing you to build AI agents with Agents SDK, collaboration tools, and real-time applications like chat or multiplayer games.

Durable Objects let you build stateful, serverless applications with millions of tiny coordination instances that run your application code alongside (in the same thread!) your durable storage. Each Durable Object can access its own SQLite database through a Storage API. A Durable Object class is defined in a Worker script encapsulating the Durable Object's behavior when accessed from a Worker. To try the code below, click the button:

Deploy to Cloudflare

import { DurableObject } from "cloudflare:workers";

// Durable Object
export class MyDurableObject extends DurableObject {
  ...
	async sayHello(name) {
		return `Hello, ${name}!`;
	}
}

// Worker
export default {
	async fetch(request, env) {
		// Every unique ID refers to an individual instance of the Durable Object class
		const id = env.MY_DURABLE_OBJECT.idFromName("foo"); …

SQLite in Durable Objects is now generally available (GA) with 10GB SQLite database per Durable Object. Since the public beta ↗︎ in September 2024, we've added feature parity and robustness for the SQLite storage backend compared to the preexisting key-value (KV) storage backend for Durable Objects.

SQLite-backed Durable Objects are recommended for all new Durable Object classes, using new_sqlite_classes Wrangler configuration. Only SQLite-backed Durable Objects have access to Storage API's SQL and point-in-time recovery methods, which provide relational data modeling, SQL querying, and better data management.

export class MyDurableObject extends DurableObject {
  sql: SqlStorage
  constructor(ctx: DurableObjectState, env: Env) {
    super(ctx, env);
    this.sql = ctx.storage.sql;
  }

  async sayHello() {
    let result = this.sql
      .exec("SELECT 'Hello, World!' AS greeting")
      .one();
    return result.greeting;
  }
}
``` …

You can now capture a maximum of 256 KB of log events per Workers invocation, helping you gain better visibility into application behavior.

All console.log() statements, exceptions, request metadata, and headers are automatically captured during the Worker invocation and emitted as JSON object. Workers Logs deserializes this object before indexing the fields and storing them. You can also capture, transform, and export the JSON object in a Tail Worker.

256 KB is a 2x increase from the previous 128 KB limit. After you exceed this limit, further context associated with the request will not be recorded in your logs.

This limit is automatically applied to all Workers.

Workflows is now Generally Available (or "GA"): in short, it's ready for production workloads. Alongside marking Workflows as GA, we've introduced a number of changes during the beta period, including:

• A new waitForEvent API that allows a Workflow to wait for an event to occur before continuing execution.
• Increased concurrency: you can run up to 4,500 Workflow instances concurrently — and this will continue to grow.
• Improved observability, including new CPU time metrics that allow you to better understand which Workflow instances are consuming the most resources and/or contributing to your bill.
• Support for vitest for testing Workflows locally and in CI/CD pipelines.

Workflows also supports the new increased CPU limits that apply to Workers, allowing you to run more CPU-intensive tasks (up to 5 minutes of CPU time per instance), not including the time spent waiting on network calls, AI models, or other I/O bound tasks.

Human-in-the-loop

The new step.waitForEvent API allows a Workflow instance to wait on events and data, enabling human-in-the-the-loop interactions, such as approving or rejecting a request, directly handling webhooks from other systems, or pushing event data to a Workflow while it's running. …

We're excited to share that you can now use Playwright's browser automation capabilities ↗︎ from Cloudflare Workers.

Playwright ↗︎ is an open-source package developed by Microsoft that can do browser automation tasks; it's commonly used to write software tests, debug applications, create screenshots, and crawl pages. Like Puppeteer, we forked ↗︎ Playwright and modified it to be compatible with Cloudflare Workers and Browser Rendering.

Below is an example of how to use Playwright with Browser Rendering to test a TODO application using assertions:

Assertion examplets

import { launch, type BrowserWorker } from "@cloudflare/playwright";
import { expect } from "@cloudflare/playwright/test";

interface Env {
	MYBROWSER: BrowserWorker;
}

export default {
	async fetch(request: Request, env: Env) {
		const browser = await launch(env.MYBROWSER);
		const page = await browser.newPage();

		await page.goto("https://demo.playwright.dev/todomvc");

		const TODO_ITEMS = [
			"buy some cheese",
			"feed the cat",
			"book a doctors appointment",
		];

		const newTodo = page.getByPlaceholder("What needs to be done?");
		for (const item of TODO_ITEMS) {
			await newTodo.fill(item); …

You can now programmatically override Cache Rules using the cf object in the fetch() command. This feature gives you fine-grained control over caching behavior on a per-request basis, allowing Workers to customize cache settings dynamically based on request properties, user context, or business logic.

How it works

Using the cf object in fetch(), you can override specific Cache Rules settings by:

1. Setting custom cache options: Pass cache properties in the cf object as the second argument to fetch() to override default Cache Rules.
2. Dynamic cache control: Apply different caching strategies based on request headers, cookies, or other runtime conditions.
3. Per-request customization: Bypass or modify Cache Rules for individual requests while maintaining default behavior for others.
4. Programmatic cache management: Implement complex caching logic that adapts to your application's needs.

What can be configured

Workers can override the following Cache Rules settings through the cf object:

• cacheEverything: Treat all content as static and cache all file types beyond the default cached content.
• cacheTtl: Set custom time-to-live values in seconds for cached content at the edge, regardless of origin headers.
• cacheTtlByStatus: Set different TTLs based on the response status code (for example, { "200-299": 86400, 404: 1, "500-599": 0 }). …

You can now access all Cloudflare cache purge methods — no matter which plan you’re on. Whether you need to update a single asset or instantly invalidate large portions of your site’s content, you now have the same powerful tools previously reserved for Enterprise customers.

Anyone on Cloudflare can now:

1. Purge Everything: Clears all cached content associated with a website.
2. Purge by Prefix: Targets URLs sharing a common prefix.
3. Purge by Hostname: Invalidates content by specific hostnames.
4. Purge by URL (single-file purge): Precisely targets individual URLs.
5. Purge by Tag: Uses Cache-Tag response headers to invalidate grouped assets, offering flexibility for complex cache management scenarios.

Want to learn how each purge method works, when to use them, or what limits apply to your plan? Dive into our purge cache documentation and API reference ↗︎ for all the details.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...622f0483

100732

Sitecore - Code Injection - CVE:CVE-2025-27218

Log

Block

This is a New Detection

Cloudflare Managed Ruleset

...0f101cca

100733

Angular-Base64-Upload - Remote Code Execution - CVE:CVE-2024-42640

Log

Block

This is a New Detection

Cloudflare Managed Ruleset

...1bbcd247

100734

Apache Camel - Remote Code Execution - CVE:CVE-2025-29891

Log

Disabled

This is a New Detection

Cloudflare Managed Ruleset

...90aea1ca

100735

Progress Software WhatsUp Gold - Remote Code Execution - CVE:CVE-2024-4885

Log

Block

This is a New Detection

Cloudflare Managed Ruleset

...d9d8c5f2

100737

Apache Tomcat - Remote Code Execution - CVE:CVE-2025-24813

Log

Block

This is a New Detection

Cloudflare Managed Ruleset

...a28a42c4

100659

Common Payloads for Server-side Template Injection

N/A

Disabled

N/A

Cloudflare Managed Ruleset

...daa4b037

100659

Common Payloads for Server-side Template Injection - Base64

N/A

Disabled

N/A

Cloudflare Managed Ruleset

...48f6a9cf

100642

LDAP Injection

N/A

Disabled

N/A

Cloudflare Managed Ruleset

...e0713e9f

100642

LDAP Injection Base64

N/A

Disabled

N/A

Cloudflare Managed Ruleset

...1bc977d1

100005

DotNetNuke - File Inclusion - CVE:CVE-2018-9126, CVE:CVE-2011-1892, CVE:CVE-2022-31474

N/A

Disabled

N/A

Cloudflare Managed Ruleset

...bb70a463

100527

Apache Struts - CVE:CVE-2021-31805 …

With Email security, you get two free CASB integrations.

Use one SaaS integration for Email security to sync with your directory of users, take actions on delivered emails, automatically provide EMLs for reclassification requests for clean emails, discover CASB findings and more.

With the other integration, you can have a separate SaaS integration for CASB findings for another SaaS provider.

Refer to Add an integration to learn more about this feature.

CASB-EmailSecurity

This feature is available across these Email security packages:

• Enterprise
• Enterprise + PhishGuard

Queues now supports the ability to pause message delivery and/or purge (delete) messages on a queue. These operations can be useful when:

• Your consumer has a bug or downtime, and you want to temporarily stop messages from being processed while you fix the bug
• You have pushed invalid messages to a queue due to a code change during development, and you want to clean up the backlog
• Your queue has a backlog that is stale and you want to clean it up to allow new messages to be consumed

To pause a queue using Wrangler, run the pause-delivery command. Paused queues continue to receive messages. And you can easily unpause a queue using the resume-delivery command.

Pause and resume a queuebash

$ wrangler queues pause-delivery my-queue
Pausing message delivery for queue my-queue.
Paused message delivery for queue my-queue.

$ wrangler queues resume-delivery my-queue
Resuming message delivery for queue my-queue.
Resumed message delivery for queue my-queue.

Purging a queue permanently deletes all messages in the queue. Unlike pausing, purging is an irreversible operation:

Purge a queuebash

$ wrangler queues purge my-queue
✔ This operation will permanently delete all the messages in queue my-queue. Type my-queue to proceed. … my-queue
Purged queue 'my-queue'
``` …

Example search for .ai domains

Cloudflare Registrar now supports .ai and .shop domains. These are two of our most highly-requested top-level domains (TLDs) and are great additions to the 300+ other TLDs we support ↗︎.

Starting today, customers can:

• Register and renew these domains at cost without any markups or add-on fees
• Enjoy best-in-class security and performance with native integrations with Cloudflare DNS, CDN, and SSL services like one-click DNSSEC
• Combat domain hijacking with Custom Domain Protection ↗︎ (available on enterprise plans)

We can't wait to see what AI and e-commerce projects you deploy on Cloudflare. To get started, transfer your domains to Cloudflare or search for new ones to register ↗︎.

The latest version of audit logs streamlines audit logging by automatically capturing all user and system actions performed through the Cloudflare Dashboard or public APIs. This update leverages Cloudflare’s existing API Shield to generate audit logs based on OpenAPI schemas, ensuring a more consistent and automated logging process.

Availability: Audit logs (version 2) is now in Beta, with support limited to API access.

Use the following API endpoint to retrieve audit logs:

GET https://api.cloudflare.com/client/v4/accounts/<account_id>/logs/audit?since=<date>&before=<date>

You can access detailed documentation for audit logs (version 2) Beta API release here ↗︎.

Key Improvements in the Beta Release:

• Automated & standardized logging: Logs are now generated automatically using a standardized system, replacing manual, team-dependent logging. This ensures consistency across all Cloudflare services.

• Expanded product coverage: Increased audit log coverage from 75% to 95%. Key API endpoints such as /accounts, /zones, and /organizations are now included.

• Granular filtering: Logs now follow a uniform format, enabling precise filtering by actions, users, methods, and resources—allowing for faster and more efficient investigations. …