You can now assign key-value tags to Access service tokens and use those tags to organize credentials or control application access. Each token supports up to five tags, such as environment: ...
AI Search billing now begins on December 1, 2026 instead of November 1, 2026. New instances sync every 24 hours by default.
JavaScript Workers with compatibility dates on or after November 17, 2026 will use URL-based module resolution and import.meta by default.
Active Durable Objects get up to 5 minutes to finish work before adopting new code. You can configure the delay or apply ...
Keyless SSL supports TLS 1.3 for ECDSA certificates. When TLS 1.3 is enabled on your zone, visitors connecting to a hostname ...
Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data ...
Cloudflare One users must first authenticate to Access or register a device with the Cloudflare One Client before SCIM ...
This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative ...
Workers Builds retains each build and its build logs for 90 days. Versions, deployments, and rollbacks are not affected.
Jurisdictions are used to create Workflows whose instances only run and store data within a region to comply with data localization regulations such as GDPR ↗︎ or FedRAMP ↗︎. Workers can still create ...
The D1 undelete API now only accepts requests for databases that were deleted within the last 7 days. Requests to undelete a ...
The supported jurisdictions are eu (the European Union), us (the United States), and fedramp (FedRAMP-Moderate data centers). A Workflow's jurisdiction is set when the Workflow is created, and cannot ...