Open Source

By rearchitecting the Images binding, we accidentally uncovered a bug that existed in the open-source hyper library across multiple major versions.

Deanna Lam, Diretnan Domnan, and Matt Lewis

When a partitioning change to our petabyte-scale ClickHouse cluster caused critical billing jobs to stall, standard metrics showed no obvious errors. This post explores how we identified severe lock contention in ClickHouse's query planner and built upstream patches to fix it.

James Morrison and Christian Endres

Panics in Rust Workers were historically fatal, poisoning the entire instance. By collaborating upstream on the wasm‑bindgen project, Rust Workers now support resilient critical error recovery, including panic unwinding using WebAssembly Exception Handling.

Guy Bedford, Hood Chatham, and Logan Gatlin

Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.

Matt “TK” Taylor and Matt Kane

Today we’re disclosing request smuggling vulnerabilities when our open source Pingora service is deployed as an ingress proxy and how we’ve fixed them in Pingora 0.8.0.

Edward Wang, Fei Deng, and Andrew Hauck

The Web streams API has become ubiquitous in JavaScript runtimes but was designed for a different era. Here's what a modern streaming API could (should?) look like.

James M Snell

One engineer used AI to rebuild Next.js on Vite in a week. vinext builds up to 4x faster, produces 57% smaller bundles, and deploys to Cloudflare Workers with a single command.

Steve Faulkner

The Cloudflare API has over 2,500 endpoints. Exposing each one as an MCP tool would consume over 2 million tokens. With Code Mode, we collapsed all of it into two tools and roughly 1,000 tokens of context.

Matt Carey

ecdysis is a Rust library enabling zero-downtime upgrades for network services. After five years protecting millions of connections at Cloudflare, it’s now open source.

Manuel Olguín Muñoz

Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.

Luke Valenta, Christopher Patton, Vânia Gonçalves, and Bas Westerbaan

Today, Cloudflare is proud to announce support for two cornerstone frameworks in the modern web ecosystem: we’re partnering with Webflow to sponsor Astro, and with Netlify to sponsor TanStack.

Rita Kozlov

Cap'n Web is a new open source, JavaScript-native RPC protocol for use in browsers and web servers. It provides the expressive power of Cap'n Proto, but with no schemas and no boilerplate.

Kenton Varda and Steve Faulkner

We are excited to announce our support of two independent, open source projects: Ladybird, an ambitious project to build an independent browser, and Omarchy, an opinionated Arch Linux for developers.

Sam Rhea

Developers have a gut-felt understanding for performance, but that intuition breaks down when systems reach Cloudflare’s scale.

Kevin Guthrie

You can now connect to Cloudflare's first publicly available remote Model Context Protocol (MCP) servers from any MCP client that supports remote servers.

Nevi Shah, Maximo Guk, and Christian Sparks

Learn about recent developments in Certificate Transparency (CT), and how we built a next-generation CT log on top of Cloudflare's Developer Platform.

Luke Valenta

You can now add a Deploy to Cloudflare button to your repository’s README when building a Workers application, making it simple for other developers to set up and deploy your project!

Nevi Shah

OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project.

Ethan Heilman