Core Platform

Workers Static Assets can now serve assets from a URL path prefix without changing their directory structure, configured via assets.base_path in Wrangler or worker.assets.basePath in cloudflare.config.ts. Requires Wrangler 4.148.0 or later, or cf 1.0.0-beta.13 or later for cloudflare.config.ts.

Setting include_attributes=true on the SQL API introspection endpoint discovers the keys of a dataset's attributes JSON column, and their types, from the preceding seven days of account data and returns them in the attributes field. include_custom_attributes and custom_attributes are deprecated but still work.

Starting with cloudflared 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules, improving security for tunnels with rules that require Cloudflare Access validation, while the path sent to the origin stays the same. The setting is off by default, but new cloudflared releases will enable it by default starting 2027-01-25, so path-based routing should be tested before then.

The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is generally available, granting read access and remote log streaming for specific Tunnel instances without write access or access to every Tunnel in the account. It includes the same access as the Read role, which does not grant log streaming.

Logpush now supports HTTP request logs as an account-scoped dataset, so one job delivers logs for every zone in an account with the ZoneName field identifying the source zone. Custom fields remain configured per zone, with no account-wide custom field configuration.

Local Explorer can now send one-off Cron Trigger invocations to a Worker's scheduled() handler during local development, removing the need to construct request URLs when testing handler behavior. The browser interface supports invoking configured cron expressions, building ad hoc expressions, setting reusable scheduled times, and inspecting outcomes and noRetry() status, and the same operation is exposed via the Local Explorer API, which takes an exact Worker name plus a cron expression and optional scheduled time.

Cloudflare Rules now supports trim(), trim_start(), and trim_end() for removing surrounding bytes, defaulting to ASCII whitespace with an optional custom byte set. The functions return nil for nil input and are available on all plans across all HTTP products.

Audit Logs v2 now records view actions for supported endpoints, corresponding to GET requests, to give visibility into read activity for security investigations. The dashboard excludes view actions by default via an Action type is not view filter, while the API and Logpush always include them.

Markdown for Agents now converts HTML with an in-process streaming engine at the edge instead of buffering responses for a separate conversion service, reducing conversion overhead and memory use. Converted responses no longer include the x-markdown-tokens or x-original-tokens headers, Content-Length is removed rather than recalculated, and the conversion limit rises to 6 MiB of decompressed HTML from 2 MiB.

A new cf.appsec.request.failed_detections field exposes an array of detection IDs that report failures from content scanning, WAF attack score, attack signature, leaked credentials, and AI prompt detections, so rules can match and handle requests with reported failures. The field returns an empty array when no failures occur and does not alter existing detection behavior.

Cloudflare now stops affected HTTP/3 requests when the client cancels its request stream instead of letting them continue to the origin, and records them as 499. Customers may see more 499 status codes for HTTP/3 traffic, reflecting more consistent reporting of existing cancellations rather than an increase in failed requests.

Log Explorer datasets are now queried from the Logs page under Observability, which combines Log Explorer and Workers Observability datasets with a shared filter builder, SQL editor, and visualizations. The Log Explorer menu is no longer shown in dashboard navigation, though enabled datasets, saved queries, and SQL queries continue to work and the previous Log Search page remains at its direct URL.

Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners, providing a top-level container for centrally managing accounts, members, analytics, and shared policies. Organization Super Administrators get implicit access to every account in their Organization without separate account memberships; Enterprise customers use a single-tier Organization while MSSP/Distributor partners can use nested sub-organizations for customer accounts. Organization Roles remains in beta with current product limitations still applying.

Two new datasets, Workers Observability — Logs and Workers Observability — Traces (OTel), let Custom Dashboards chart Worker invocations, log levels, errors, CPU and wall time, span counts, and durations alongside HTTP traffic and security events. The datasets are available for Workers with Workers Logs or Workers Traces enabled, and accounts can now have up to 100 dashboards.

hash_in_range() is globally available for HTTP products on all plans, hashing fields into an integer within a specified range to select a portion of requests. Cloudflare for SaaS users can control rollout progression with custom metadata keys like rollout_pct.