Vercel Firewall protects against SAMLStorm vulnerability
Vercel has deployed a proactive security update to protect against the SAMLStorm vulnerability in the xml-crypto package that could allow attackers to bypass authentication mechanisms. Vercel Firewall automatically mitigates this risk, but customers should update xml-crypto to version 6.0.1, 3.2.1, or 2.1.6.
We have deployed a proactive security update to the , protecting against a recently disclosed vulnerability in the package, dubbed SAMLStorm ( and ). This vulnerability, which affects various SAML implementations, could allow attackers to bypass authentication mechanisms.Vercel Firewallxml-cryptoCVE-2025-29774CVE-2025-29775
See the for more details on the vulnerability, and reach out to if you have questions.SAMLStorm reportVercel Support
What This Means for Vercel Customers
: Vercel Firewall automatically mitigates this risk for you, but updating xml-crypto is still recommendedAutomatic protection with the Vercel Firewall
: If you're using xml-crypto package 6.0.0 and earlier, or a package that depends on xml-crypto, update to 6.0.1, 3.2.1, or 2.1.6 for the patched versionsUpdate xml-crypto
We'll continue to monitor for new developments and provide updates as necessary
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.