Changelog: Next-Gen WAF

This changelog provides information on changes across the Fastly platform, including to the VCL language, our public API, CLI, the Terraform provider, Terraform provider (beta), Compute Rust SDK, Compute JavaScript SDK, Compute Go SDK, and the Next-Gen WAF.

• November 10, 2025
  Next-Gen WAF announcementsAdditions

  Protection from CVE-2025-64459 (Django SQL injection via _connector or _negated)

• November 6, 2025
  Next-Gen WAF rulesAdditions

  Added virtual patch for CVE-2025-64459

• October 10, 2025
  Next-Gen WAF announcementsAdditions

  Protection from CVE-2025-61882 (Oracle E-Business Suite Pre-Auth Remote Code Execution)

• October 9, 2025
  Next-Gen WAF agentChanges

  Next-Gen WAF agent 4.71.0

• October 9, 2025
  Next-Gen WAF announcementsAdditions

  Next-Gen WAF agent is now FIPS 140-3 compliant

• October 8, 2025
  Next-Gen WAF rulesAdditions

  Added virtual patch for CVE-2025-61882

• October 6, 2025
  Next-Gen WAF for NGINX (Native)Changes

  Next-Gen WAF for NGINX (Native) 1.4.0

• September 12, 2025
  Next-Gen WAF announcementsAdditions

  Protection from CVE-2025-54236 (Adobe Commerce and Magento Open Source Unauthenticated API Access)

• September 11, 2025
  Next-Gen WAF agentChanges

  Next-Gen WAF agent 4.70.0

• September 9, 2025
  Next-Gen WAF rulesAdditions

  Added virtual patch for CVE-2025-54236