Fixed Disallow accessing HTML rewriter elements outside of handlers (#1541) (bf4ac3d) dynamic backends disabled exception (#1535) (432d059) Make headers of cloned requests independent (#1539) (9b34c43) Memory leak in Backend::health_for_name (#1542) (43e03d2) Memory leak in Device::lookup (#1543) (2f02080) URLSearchParams premature free (#1538) (da5146c)
An arbitrary file read vulnerability that can potentially enable remote code execution (RCE) has been found in Ruby on Rails Active Storage and has been assigned CVE-2026-66066. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel From the Ru…
Improved logging to include failed-open requests.
Fixed release: target was renamed with this version bump (#1532) (fffa2d2)
Fixed ci: get releases working for real this time (#1531) (0c734bd) Miscellaneous Chores release 3.44.1 (9061855)
Fastly DNS is our authoritative DNS service that leverages Fastly's global, high-performance edge network to serve DNS query responses.
Added bot detection (#1524) (0b26045) Fixed cache: handle error (#1519) (a8d55a8) tests: fix failing cache test (#1520) (8e56d11) tests: Make test suite properly fail when a test fails (#1518) (ea4c7c7)
Fixed Allow 0 ttl for responses (#1498) (55005ce) docs: fix docs generation (b2b4752) fmt: format with updated prettier (c4f36ad) reset SDK state between requests (#1488) (e049f97) Reusable sandbox tests (#1515) (c038f48) tests: only run null-304-body test when http-cache enabled (#1505) (58e72b0)
View this release on GitHub. ENHANCEMENTS: feat(tls_subscription_validation): expose computed certificate_id, allowing issuance-dependent resources to be chained in a single apply (#1345) feat(tls/subscription): include subscription ID and domains in fastly_tls_subscription API error messages so failing resources can be identified when managing many subscriptions (#1344) BUG FIXES: fix(logging): V…
You can now use the Historical Domain Inspector API and the Real-Time Domain Inspector API to understand the distribution of TLS and HTTP versions used by incoming requests.
A chain of vulnerabilities leading to remote code execution (RCE) have been found in WordPress and have been assigned CVE-2026-63030 and CVE-2026-60137, colloquially known as wp2shell. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel From…
Removed the Ruby/ERB runtime dependency by generating agent configuration directly in the startup wrapper.
View this release on GitHub. BUG FIXES: fix(ngwaf/signals): increase character limit of the name attribute to 128 (#1338) fix(ngwaf/rules): allow templated_signal rules to be created without conditions (#1330) Dependencies build(deps): go.mongodb.org/mongo-driver from 1.17.4 to 1.17.7 (#1309) build(deps): github.com/fastly/go-fastly/v16 from 15.0.3 to 16.0.0 (#1332) build(deps): github.com/fastly/…
Fixed an issue introduced in 4.80.0 where the agent may not inspect traffic as expected under certain configurations.
Fixed an issue introduced in 4.80.0 where the agent may not inspect traffic as expected under certain configurations. Upgraded to Golang 1.26.4 Improved CMDEXE detection Improved TRAVERSAL detection Improved XSS detection Updated base GeoIP data: July 2026
View this release on GitHub. Bug Fixes: fix(auth): accept SSO JWT audiences with or without a trailing slash when validating the Fastly API endpoint. (#1837) feat(compute): add install-tools command to pre-install the Viceroy binary (#1833) Enhancements: feat(ngwaf/timeseries): add support for account and workspace times series commands (#1823) Dependencies: build(deps): github.com/fastly/go-fastl…
Upgraded to Golang 1.26.4 Improved CMDEXE detection Improved TRAVERSAL detection Improved XSS detection Updated base GeoIP data: July 2026
Five new integration types are now supported in the Notifications API: Datadog, Jira Issue, Jira Service Management, OpsGenie, and Splunk On-Call. You can use these integrations to route observability alerts and audit log event notifications to the tools your team already uses for incident management and issue tracking.
If you don't have access to the Next-Gen WAF in the Fastly control panel, you can now connect your Fastly account to your Next-Gen WAF corp. Once connected, you gain access to the Next-Gen WAF and (if purchased) Bot Management through the Fastly control panel and Fastly API while retaining access to the Next-Gen WAF control panel and Next-Gen WAF API. As your WAF configurations and user accounts a…
We've introduced a new Routing Configurations API that allows you to define routing rules based on URL paths and conditions to route traffic to different services. We've also updated the Domains API to support associating domains with routing configurations, allowing you to apply those rules consistently across multiple domains.
You can now create, manage, and query notification event mappings using the new Event Mappings API. Event mappings define which Fastly audit events trigger notifications to your configured integrations, and for which services or workspaces. Mappings can be scoped account-wide or targeted to specific CDN (VCL) services, Compute (Wasm) services, or Next-Gen WAF workspaces. Two discovery endpoints ar…
You can now use the Historical Stats API and the Real-Time Analytics API to troubleshoot backend Compute errors. Sixteen new metrics attribute each backend Compute error to TLS, HTTP, DNS, connection issues, or other sources.
View this release on GitHub. Enhancements: feat(kvstoreentry/delete): Add support for multiple-key deletion using a key prefix. (#1822) build(dockerfile-go): add Go Dockerfile alongside the existing Node and Rust ones (#1828) feat(compute/deploy): Support 'contentguard' configuration on 'bot_management' product under [setup.products] (#1827) Dependencies: build(deps): github.com/nwaples/rardecode/…
Account-level requests are now available on the Requests page for the Fastly control panel only. This lets you easily view and filter requests across all workspaces in your account. For more information, read our Monitoring requests guide.
fsthttp: ensure stale-if-error options are passed to ABI hostcall (#265)
kvstore: allow streaming bodies on insert (#240) fsthttp: fix broken api for DownstreamTLSCientCertVerifyResult (#241) fsthttp: add bot detection hostcalls (#242) fsthttp: add ResVPNProxy support (#243, #247) fsthttp: Add stale-if-error logic to http caching layer (#236) kvstore: add IfGenerationMatch to InsertConfig (#246) kvstore: restore missing error check for io.Copy() (#251) fsthttp: prevent…
The Next-Gen WAF Simulate API now includes a detector_scope field on every signal in the simulation response, achieving parity with the /requests/{id} API. The field indicates whether a signal was detected by a system (built-in WAF rule), workspace (workspace-level custom rule), account (account-level custom signal), or unknown scope detector. The request body size limit has also increased from 10…
The Next-Gen WAF Requests API now includes an account-level endpoint for searching requests using GET /ngwaf/v1/requests. This allows you to search for requests across all workspaces in your account, with each result including a workspace_id field to identify which workspace the request belongs to.
A new block_immediately action is available for thresholds. When set, every request carrying the configured signal is blocked unconditionally, with no rate window applied. Supported for Pentest, CVE, XXE, and AWS-SSRF signals.
Fixed base64 patch wasn't applying cleanly (#1494) (9311b97)