Cloudflare breaking changes, updated weekly
Every verified Cloudflare trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all Cloudflare traps.
fg-0573· added 2026-10-30· last checked 2026-10-30
MCP tool-call analytics counts drop because response_status now defaults to success
Symptom
Tool-call timeseries totals are lower than before 2026-10-28
Fix
Pass response_status=all to get the old all-status counts, or choose error or cached to count one status.
fg-0574· added 2026-10-30· last checked 2026-10-30
Build breaks on agents:skills import, SkillRegistry or skillWorkspace after Agents SDK 0.32.0
Symptom
Cannot resolve the agents:skills Vite import
Fix
Upgrade to Agents SDK 0.32.0 and Think 0.23.0 or later, return skills.workspace(this.workspace) or skills.r2(...) from getSkills(), and import runner from agents/skills/runner.
fg-0575· added 2026-10-30· last checked 2026-10-30
Cross-zone Worker subrequest to a BYOIP hostname sees CF-Connecting-IP 2a06:98c0:3600::103
Symptom
Origin or WAF rules see client IP 2a06:98c0:3600::103 for requests from a Worker in another zone
Fix
Do not key rules on the CF-Connecting-IP of cross-zone Worker subrequests. Match on the CF-Worker header or the cf.worker.upstream_zone field, or pass the original client IP in your own header.
fg-0581· added 2026-10-30· last checked 2026-10-30
Durable Object keeps running old code for up to 5 minutes after wrangler deploy
Symptom
A Durable Object still returns old behavior right after a deploy
Fix
For a deployment that needs the new code at once, use immediate mode. To change the default window, set code_update_strategy with a max_delay in seconds (0 to 86400) in the Wrangler config.
fg-0547· added 2026-10-24· last checked 2026-10-24
Think agent starts with an empty workspace after moving from @cloudflare/shell to @cloudflare/computer
Symptom
Agent files are missing after upgrading Think
Fix
Copy existing files into the new workspace with the migration script in the official guide before switching. Add WorkerJavaScriptBackend if you need JS execution.
fg-0548· added 2026-10-24· last checked 2026-10-24· deadline 2027-01-25
Tunnel path-based ingress rules may match differently once URL normalization becomes default on 2027-01-25
Symptom
Requests that matched one ingress rule start matching another after upgrading cloudflared
Fix
Turn normalization on now in a test environment and verify path routing before the default flips. You can also set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each replica and restart it.
fg-0558· added 2026-10-24· last checked 2026-10-24
Sandbox containers before 0.12.14 trust compromised eMudhra intermediate CA certificates
Symptom
HTTPS from the sandbox to test hosts at emudhra.we-have-a-problem.com succeeds instead of failing
Fix
Upgrade @cloudflare/sandbox to 0.12.14 and update the Dockerfile FROM line, keeping any -python, -opencode or -musl suffix. For 1.x, docker pull base images, run docker builder prune --all, redeploy, destroy running sandboxes, and recreate snapshots from the new image.
fg-0549· added 2026-10-24· last checked 2026-10-24
Wrangler 4.150.0 uploads source maps by default on deploy
Symptom
Source maps appear in Workers after upgrading Wrangler without config changes
Fix
Set upload_source_maps to false to opt out, or true to make unresolvable maps fail the upload. For cf or the Vite plugin, set build.sourcemap to false.
fg-0536· added 2026-10-17· last checked 2026-10-17
cf CLI commands stop working after update with unknown command errors for camelCase names like getCredits
Symptom
cf accounts billing getCredits fails with an unknown command error
Fix
Update scripts to the kebab-case command names and check the CLI release notes for renamed flags, or pin the older beta version in CI until you migrate.
fg-0544· added 2026-10-17· last checked 2026-10-17
Stream WebRTC live delivery starts billing on 2026-10-15 after leaving beta
Symptom
Unexpected Stream charges for minutes delivered via WebRTC playback
Fix
Review Stream pricing and the new WebRTC analytics and usage charts, and cap or monitor live viewership before enabling WebRTC playback in production.
fg-0208· added 2026-10-15· last checked 2026-10-15
App on port 3000 or 5000 times out once its DNS record is proxied through Cloudflare
Symptom
Connection timed out to https://app.example.com:3000
Fix
Serve the app on a supported port behind a reverse proxy, or set the record to DNS only.
fg-0209· added 2026-10-15· last checked 2026-10-15
cloudflare_dns_record apply fails with 'Provider produced inconsistent result' on modified_on after upgrading to 5.26
Symptom
Provider produced inconsistent result after apply ... .modified_on: was ... but now ...
Fix
Upgrade the provider to 5.28.0 or later and run plan again.
fg-0211· added 2026-10-15· last checked 2026-10-15
Cloudflare Terraform provider v5 plans and applies fail with 429 on accounts with many resources
Symptom
Error: failed to make http request ... 429 Too Many Requests
Fix
Lower parallelism, split large stacks, and use refresh=false for targeted changes. Enterprise accounts can ask support for higher limits.
fg-0216· added 2026-10-15· last checked 2026-10-15
Upgrading the Cloudflare Terraform provider to v5 breaks cloudflare_record and zone settings resources
Symptom
The provider cloudflare/cloudflare does not support resource type "cloudflare_record".
Fix
Run tf-migrate in dry run, then apply its HCL rewrites and moved blocks, and follow the zone_settings_override removal steps on the v4 provider before switching.
fg-0220· added 2026-10-15· last checked 2026-10-15
Worker throws 'Too many subrequests' after about 50 fetch calls in one request
Symptom
Error: Too many subrequests. Workers can make up to 50 subrequests per request.
Fix
Batch upstream calls or move the fan out into a Queue or Workflow. On Paid, raise limits.subrequests if 10,000 is not enough.
fg-0222· added 2026-10-15· last checked 2026-10-15
Wrangler deploy --env production ships without the vars, KV, or D1 bindings defined at the top level
Symptom
env.DB is undefined in the production environment Worker
Fix
Repeat vars and every binding block inside each [env.NAME] section, pointing at that environment's resources.
fg-0218· added 2026-10-15· last checked 2026-10-15
Worker build fails to resolve node:crypto or node:buffer even though Workers support Node APIs
Symptom
No such module "node:crypto".
Fix
Add nodejs_compat to compatibility_flags, or move compatibility_date to 2026-08-04 or later after testing other date gated changes.
fg-0221· added 2026-10-15· last checked 2026-10-15
wrangler d1 execute fails with 'SQL code did not contain a statement' when a comment holds a semicolon
Symptom
SQL code did not contain a statement
Fix
Upgrade Wrangler to 3.109.3 or later, or remove semicolons from comments in migration files.
fg-0210· added 2026-10-15· last checked 2026-10-15
Cloudflare shows cf-cache-status DYNAMIC and never caches HTML or JSON responses
Symptom
cf-cache-status: DYNAMIC on every HTML page
Fix
Add a Cache Rule that marks the paths as eligible for cache, and stop sending Set-Cookie on public pages.
fg-0212· added 2026-10-15· last checked 2026-10-15
Long requests through Cloudflare fail with Error 524 after about two minutes
Symptom
Error 524: A timeout occurred
Fix
Return quickly and finish the work in the background with a job id the client polls, or serve the long endpoint from a DNS only hostname.
fg-0213· added 2026-10-15· last checked 2026-10-15
process.env is empty in a Cloudflare Worker while env.MY_VAR works inside fetch
Symptom
process.env.API_KEY is undefined in a deployed Worker
Fix
Read env from the handler, or import env from cloudflare:workers for module scope access. For libraries that need process.env, enable nodejs_compat with a date of 2025-04-01 or later.
fg-0214· added 2026-10-15· last checked 2026-10-15
R2 presigned URL fails when the host is swapped for the bucket custom domain or r2.dev
Symptom
A presigned GET or PUT returns 403 once the host is changed to the bucket custom domain
Fix
Generate and use presigned URLs against the S3 endpoint, add a CORS rule for your origin, and keep the custom domain for public reads.
fg-0215· added 2026-10-15· last checked 2026-10-15
Site behind Cloudflare loops with ERR_TOO_MANY_REDIRECTS after the origin forces HTTPS
Symptom
ERR_TOO_MANY_REDIRECTS in the browser
Fix
Install a certificate on the origin and switch the zone to Full (strict), or drop the origin redirect and use Always Use HTTPS at Cloudflare.
fg-0217· added 2026-10-15· last checked 2026-10-15
Webhooks and API clients get challenged by Cloudflare Bot Fight Mode and a WAF Skip rule does not help
Symptom
Stripe or GitHub webhook deliveries fail with 403 and a challenge page
Fix
Turn Bot Fight Mode off for the zone, or use Super Bot Fight Mode (Pro and up) which supports Skip rules, or allow the sender's IPs with an IP Access rule.
fg-0219· added 2026-10-15· last checked 2026-10-15
Worker on the Free plan fails with Error 1102 'Worker exceeded resource limits' under normal load
Symptom
Error 1102: Worker exceeded resource limits
Fix
Move the Worker to Workers Paid and set a CPU limit, or move heavy work out of the request path.
fg-0012· added 2026-09-22· last checked 2026-09-22
curl to a Cloudflare-proxied site gets 403 'Just a moment...' with a short User-Agent
Symptom
HTTP 403 with a Just a moment... page
Fix
Send a full, realistic browser User-Agent when testing or scripting against the site. Never conclude a URL is 404 from a 403. Note: scripts calling any Cloudflare-fronted API, not only zones on the plan named below, can instead get error code: 1010 (a browser signature block) for a default library User-Agent; the same fix applies.
fg-0011· added 2026-09-04· last checked 2026-09-04
Cloudflare MCP server URL ending in /sse returns 410
Symptom
410 Gone from https://observability.mcp.cloudflare.com/sse
Fix
Point the client at the /mcp endpoint with HTTP transport and authorize again.
Have your agent check Cloudflare changes before it codes