F
Next-Gen WAF agent 4.83.2
Fixed a bug in advanced client-side detection feature Updated base GeoIP data: November 2026
F
JavaScript SDK 4.1.0
Added Upgrade StarlingMonkey (3e17e8a) Upgrade StarlingMonkey to v0.4.0 (#1610) (0a776ea) Fixed cache: fix issues with if-none-match and if-match (#1611) (d3322b0) tests: fix tests using wrong variable name (#1612) (0e4c267)
F
Fastly Terraform Provider (beta) 0.2.7
View this release on GitHub. ENHANCEMENTS: feat(migration): add the initial fastly-tf-migrate CLI foundation with urfave/cli/v3, version reporting, and dedicated build/test targets (#198) feat(service_cdn_auto): support legacy simple product enablement state during VCL-to-CDN Auto migration (#191) feat(audit-log-event-mapping): add fastly_audit_log_event_mapping resource and data source for routin…
F
Rust SDK 0.13.2
Support adding a between-bytes timeout for shield backends. Add Request::get_vpn_proxy_data, Request::get_vpn_proxy_* and RequestHandle::vpn_proxy_* methods for exposing the metadata for detecting whether the downstream client is residential, a VPN, or proxy. Add fastly::compute_runtime::products, which reports which products are enabled on the service. When Request::with_image_optimizer is used o…
F
Fastly Terraform Provider (beta) 0.2.6
View this release on GitHub. ENHANCEMENTS: feat(ngwafworkspace): add support for automated virtual patching (#190) feat(service_cdn_auto): add a proof-of-concept state migration path from legacy fastly_service_vcl resources (#180)
F
Fastly Terraform Provider 10.1.0
View this release on GitHub. ENHANCEMENTS: feat(ngwaf_workspace): add support for Automated Virtual Patching (#1463)
F
Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell)
A buffer overflow vulnerability that can lead to remote code execution has been found in the Google Brotli decompression library (versions 1.0.3 through 1.2.0), used by Node.js, Python and other software, and has been assigned CVE-2026-111497. Fastly has created a virtual patch for it that is now available within your account. If you’ve previously enabled the Automatic CVE Virtual Patching setting…
F
CLI v17.0.0
View this release on GitHub. Breaking: breaking(ai-runtime-control): key create no longer accepts the --user-id flag, as it was removed from the API (#1949) breaking(json): --json output for ai-runtime-control usage-metrics list, ngwaf workspace list, ngwaf rule list and ngwaf workspace rule list is now a bare array instead of an object with data and meta (#1949) Bug Fixes: fix(ai-runtime-control)…
F
Automatically enable new virtual patches for Next-Gen WAF workspaces
Next-Gen WAF workspaces now have an auto_enable_new_virtual_patches setting. When it's true, virtual patches released after you turn it on are enabled for the workspace automatically in block mode, so new vulnerabilities are mitigated without you enabling each patch yourself. Virtual patches released before you turned it on aren't changed. Set it when you create a workspace or update a workspace.…
F
Automatically enable CVE virtual patches
You can now enable the Automatic CVE Virtual Patching setting in the Fastly control panel to have all future CVE virtual patches automatically applied to your workspace as soon as they're released. This setting only affects virtual patches that are released after the setting is enabled and does not enable previously released virtual patches.
F
Next-Gen WAF agent 4.83.1
Upgraded to Golang 1.26.10 Updated base GeoIP data: October 2026
F
Fastly Terraform Provider (beta) 0.2.5
View this release on GitHub. ENHANCEMENTS: feat(provider): add api_endpoint provider argument (and FASTLY_API_URL environment variable) to target a non-default Fastly API endpoint; https only (#187) BUG FIXES: fix(alert): description is now limited to 4075 characters so the appended "Managed by Terraform" text stays within the API's 4096 limit and leading/trailing whitespace no longer causes an "i…
F
Added virtual patch for CVE-2026-109618 and CVE-2026-109619
Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP ver…
F
Fastly Terraform Provider 10.0.0
View this release on GitHub. BREAKING: breaking(ai_runtime_control_virtual_key): removing user_id as a configurable argument, as it was never supported by the Create endpoint. It is now a read-only (computed) attribute. ENHANCEMENTS: feat(alert): Add support for monitoring multiple services using a single alert. (#1454) BUG FIXES: fix(ai_runtime_control): update AI Runtime Control resource and dat…
F
Fastly Terraform Provider (beta) 0.2.4
View this release on GitHub. ENHANCEMENTS: feat(docs): extend the beta testing guide with an explicit resource family workflow using terraform query and service-scoped discovery (#161) BUG FIXES: fix(ngwaf_workspace): client_ip_headers no longer causes an "inconsistent result after apply" error when set to an empty list (#178) fix(healthcheck): explicitly empty headers no longer causes an "inconsi…
F
Retrieve historical metrics with improved performance and flexibility
You can now retrieve historical metrics data more efficiently using the new Platform Metrics API endpoints. This makes it easier to analyze traffic patterns and resource usage across your services. The API supports cursor-based pagination for large datasets, predefined metric sets that bundle related metrics, and flexible grouping by point of presence or datacenter.
F
Added protection for CVE-2026-103849: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine (BlockStrap)
The virtual patch for CVE-2026-75650: Adobe Commerce and Magento Unauthenticated SSTI (StyleSmuggler), released on September 9, 2026, has been updated to address the vulnerabilities caused by improper neutralization of special elements used in a template engine, which was assigned CVE-2026-103849 (BlockStrap). If you have already activated the virtual patch for CVE-2026-75650, you are automaticall…
F
CLI v16.2.0
View this release on GitHub. Bug Fixes: fix(secret-store): return [] instead of null when no secret stores exist (#1892) fix(service): allow service version validate to use FASTLY_SERVICE_ID (#1907) fix(compute): for compute subcommands, properly report a missing name in fastly.toml instead of "file not found" (#1916) fix(compute): remove the hardcoded -gc=conservative flag from the tinygo build c…
F
JavaScript SDK 4.0.1
Fixed Add lockfile to weval install (#1607) (bd917a0) deps: bump weval to 0.5.1 (#1604) (7bb2844) dep: Update to weval@0.5.0 and @bytecodealliance/jco@1.17.9 (#1601) (769f43b)
F
Fastly Terraform Provider (beta) 0.2.3
View this release on GitHub. ENHANCEMENTS: feat(query): add optional service_id filtering to service-scoped terraform query List Resources (#172) feat(image_optimizer_default_explicit): add support for explicit image optimizer defaults and terraform query support (#162) feat(request_setting): add fastly_service_request_setting explicit/default resource and terraform query support (#167) feat(respo…
F
Next-Gen WAF agent 4.83.0
Upgraded to Golang 1.26.9 Updated base GeoIP data: October 2026
F
Added virtual patch for CVE-2026-21589 (Pre-Auth Arbitrary File Read in Multiple Atlassian Products)
A pre-authorization arbitrary file read vulnerability has been found in multiple Atlassian products (e.g., Confluence, Jira, Bitbucket) and has been assigned CVE-2026-21589. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below. Next-Gen WAF control panel From the Rules…
F
Add API Enforcement metrics to Historical Stats and Real-Time Analytics APIs
The Historical Stats API and Real-Time Analytics API now track API Enforcement requests via the new api_enforcement_allowed_requests_count and api_enforcement_flagged_requests_count metrics.
F
JavaScript SDK 4.0.0
Changed this enables AOT compilation by default, which might be unexpected, but will make our default operation much faster. Added Allow URIs longer than 8192 bytes (#1585) (6ac66df) enable AOT by default (#1598) (dfcc17f) Fixed change zip extractor for wasmtime package (5a8886e) Ensure additions to headers in beforeSend are applied (#1600) (1ae9e5b) get documentation generation working again (#15…
F
Go SDK 1.11.0
fsthttp: fix BeforeSend receiving the original request's headers instead of the suggested backend request's (#305) fsthttp: fall back to stale-if-error response when BeforeSend hook or suggested backend request fails fsthttp: support timeouts for http cache lookups examples: add grpc-proxy example
F
Fastly Terraform Provider (beta) 0.2.2
View this release on GitHub. ENHANCEMENTS: feat(healthchecks_explicit): add support for explicit healthchecks and terraform query support (#160) feat(director): add fastly_service_director explicit/default resource (#159) feat(header): add fastly_service_header explicit/default resource for caller-managed service version lifecycle (#163) BUG FIXES: fix(query): restore stable resource identities fo…
F
Purge a service's staging environment through the API
You can now purge the cache of a service's staging environment through the API, so that tests on a staged version see your latest content. Add the Fastly-Purge-Environment: staging header to a purge everything, purge by surrogate key tag, or purge multiple surrogate key tags request. Without this header, a purge applies to the production environment. To purge an individual URL from the staging env…
F
New anomaly signal: INSECURE-DESER
We have introduced a new anomaly signal: Insecure Deserialization (INSECURE-DESER): Insecure Deserialization is the attempt to exploit unsafe deserialization of data. Note that this signal will be converted to an attack signal at a future date.
F
Fastly Terraform Provider (beta) 0.2.1
View this release on GitHub. ENHANCEMENTS: feat(docs): add intro content to the provider landing page (#151) Dependencies: build(deps): github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.0 (#153)
F
Monitor a stat across all or a set of services individually using a single alert definition
You can now monitor multiple services with a single alert definition using the Alerts API. When creating alerts for stats metrics, set service_id to an empty string and specify target services in the dimensions.services array to receive alerts for each service (not aggregated). Use an empty sequence to monitor all services, or specify up to 10 service IDs to monitor specific services. Alert histor…