Kentaro Iwata

We appreciate your patience and understanding as we work to deliver a secure and reliable release. Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address: - 3 high severity issues - 4 medium severity issues - 1 low severity issue nodejs.org/en/blog/vulner…

So @Cloudflare is making you pay to fix their bug. Here’s the situation: Modern frameworks like @nextjs App Router use the HTTP Vary header (defined in RFC 7231) to tell CDNs: “Cache HTML and RSC payloads separately, based on request headers.” Example: /page with no RSC header → returns HTML (text/html) /page with RSC header → returns RSC payload (text/x-component)Next.js sets:Vary: RSC, Next-Router-State-Tree, Next-Url, ... Every major CDN (@fastly , @cloudfront , @Akamai ) respects this, so they cache and serve HTML vs RSC correctly. Cloudflare does not. They completely ignore Vary (except Accept-Encoding). Result: If HTML is cached first, client navigations break (RSC request gets HTML). If RSC is cached first, page reloads show raw RSC payload as text instead of HTML. I opened a support ticket. Their answer? They admitted Cloudflare is non-compliant by design and told me if I want correct behavior, I need to upgrade to Enterprise. In other words: @CloudflareDev is deliberately ignoring a core part of the HTTP spec… and charging you extra to patch around the fallout. Workarounds exist (Workers, query params), but they shouldn’t be necessary. This isn’t a “feature request”, it’s a standards compliance bug that breaks Next.js and any framework relying on Vary. Other CDNs respect the spec. Cloudflare does not. cc @vercel @rauchg