megachangelog
Feature

DeepSeek V4 Flash and Pro now available on Workers AI

DeepSeek V4 Flash and V4 Pro models are now available on Workers AI, featuring a full 1 million token context window for long-horizon agentic workflows. Both models support reasoning, function calling, and are accessible via Workers AI binding, REST API, OpenAI-compatible endpoint, or AI Gateway.

@cf/deepseek-ai/deepseek-v4-pro-0813 and @cf/deepseek-ai/deepseek-v4-flash-0731 are now available on Workers AI.

DeepSeek V4 Flash and DeepSeek V4 Pro are the first Workers AI models with a full one million (1,048,576) token context window. Use them for long-horizon agentic workflows, large codebases, and multi-step reasoning that exceed the context limits of every other model hosted on the platform.

DeepSeek V4 Flash is the faster, lower-cost sibling. This release supersedes the preview version with substantially enhanced agentic capabilities.

Key capabilities:

  • Reasoning: Both models support thinking mode for complex, step-by-step problem-solving.
  • Function calling: Build agents that invoke tools and APIs across multiple conversation turns.
  • Long context: Both models support a full 1,048,576 token context window.

Both models require the Workers Paid plan or prepaid AI Gateway credits.

Use these models through the Workers AI binding (env.AI.run()), the REST API, the OpenAI-compatible endpoint, or AI Gateway.

For more information, refer to the DeepSeek V4 Pro model page, the DeepSeek V4 Flash model page, and pricing.

workers-aimodelsdeepseekaiapi

Source: original entry ↗

More from Cloudflare

Follow Cloudflare to get its new changes in your feed and email digest.

Feature

Rules - Remove surrounding bytes with trim functions

Cloudflare Rules now supports three new functions—trim(), trim_start(), and trim_end()—to remove surrounding bytes from values before comparison. These functions work across all HTTP products on all plans and can remove ASCII whitespace by default or custom byte sets specified as an optional parameter.

ruleshttpapifunctionstext-processing
Feature

Infrastructure applications support configurable session duration

Infrastructure applications now support configurable session duration with a default of 24 hours, set via dashboard or API. When the session duration expires, active SSH connections are closed and users must reconnect, improving security and predictability compared to the previous behavior where sessions could persist unpredictably.

accessinfrastructuresshsession-managementsecurity
Security2026-10-14

Emergency WAF managed rule for active RCE vulnerability

Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.

wafsecurityrcemanaged-rulesemergency
See all Cloudflare changes →