How we found a bug in the hyper HTTP library
2026-06-22
By rearchitecting the Images binding, we accidentally uncovered a bug that existed in the open-source hyper library across multiple major versions....
Continue reading »
Our billing pipeline was suddenly slow. The culprit was a hidden bottleneck in ClickHouse
2026-05-14
When a partitioning change to our petabyte-scale ClickHouse cluster caused critical billing jobs to stall, standard metrics showed no obvious errors. This post explores how we identified severe lock contention in ClickHouse's query planner and built upstream patches to fix it....
Making Rust Workers reliable: panic and abort recovery in wasm‑bindgen
2026-04-22
Cloudflare WorkersRustRust WorkersWebAssemblyWASMReliabilityEngineeringOpen SourceDeveloper PlatformDevelopers
Panics in Rust Workers were historically fatal, poisoning the entire instance. By collaborating upstream on the wasm‑bindgen project, Rust Workers now support resilient critical error recovery, including panic unwinding using WebAssembly Exception Handling....
Introducing EmDash — the spiritual successor to WordPress that solves plugin security
2026-04-01
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates....
Fixing request smuggling vulnerabilities in Pingora OSS deployments
2026-03-09
Today we’re disclosing request smuggling vulnerabilities when our open source Pingora service is deployed as an ingress proxy and how we’ve fixed them in Pingora 0.8.0. ...
MORE POSTS
February 27, 2026
We deserve a better streams API for JavaScript
The Web streams API has become ubiquitous in JavaScript runtimes but was designed for a different era. Here's what a modern streaming API could (should?) look like....
- By
February 24, 2026
How we rebuilt Next.js with AI in one week
One engineer used AI to rebuild Next.js on Vite in a week. vinext builds up to 4x faster, produces 57% smaller bundles, and deploys to Cloudflare Workers with a single command....
- By
February 20, 2026
Code Mode: give agents an entire API in 1,000 tokens
The Cloudflare API has over 2,500 endpoints. Exposing each one as an MCP tool would consume over 2 million tokens. With Code Mode, we collapsed all of it into two tools and roughly 1,000 tokens of context....
- By
February 13, 2026
Shedding old code with ecdysis: graceful restarts for Rust services at Cloudflare
ecdysis is a Rust library enabling zero-downtime upgrades for network services. After five years protecting millions of connections at Cloudflare, it’s now open source....
- By
October 28, 2025
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships....
- By
September 23, 2025
Why Cloudflare, Netlify, and Webflow are collaborating to support Open Source tools like Astro and TanStack
Today, Cloudflare is proud to announce support for two cornerstone frameworks in the modern web ecosystem: we’re partnering with Webflow to sponsor Astro, and with Netlify to sponsor TanStack....
- By
September 22, 2025
Supporting the future of the open web: Cloudflare is sponsoring Ladybird and Omarchy
We are excited to announce our support of two independent, open source projects: Ladybird, an ambitious project to build an independent browser, and Omarchy, an opinionated Arch Linux for developers. ...
- By
September 22, 2025
Cap'n Web: a new RPC system for browsers and web servers
Cap'n Web is a new open source, JavaScript-native RPC protocol for use in browsers and web servers. It provides the expressive power of Cap'n Proto, but with no schemas and no boilerplate....
- By
May 20, 2025
Performance measurements… and the people who love them
Developers have a gut-felt understanding for performance, but that intuition breaks down when systems reach Cloudflare’s scale....
- By
May 01, 2025
Thirteen new MCP servers from Cloudflare you can use today
You can now connect to Cloudflare's first publicly available remote Model Context Protocol (MCP) servers from any MCP client that supports remote servers. ...
- By
April 11, 2025
A next-generation Certificate Transparency log built on Cloudflare Workers
Learn about recent developments in Certificate Transparency (CT), and how we built a next-generation CT log on top of Cloudflare's Developer Platform....
- By
April 08, 2025
Skip the setup: deploy a Workers application in seconds
You can now add a Deploy to Cloudflare button to your repository’s README when building a Workers application, making it simple for other developers to set up and deploy your project! ...
- By
March 25, 2025
Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project....
- By
January 08, 2025
Open source all the way down: Upgrading our developer documentation
At Cloudflare, we treat developer content like an open source product. This collaborative approach enables global contributions to enhance quality and relevance for a wide range of users....
- By
October 22, 2024
Is this thing on? Using OpenBMC and ACPI power states for reliable server boot
Cloudflare’s global fleet benefits from being managed by open source firmware for the Baseboard Management Controller (BMC), OpenBMC. This has come with various challenges, some of which we discuss here with an explanation of how the open source nature of the firmware for the BMC...
- By