Vercel security roundup: bot defenses, DoS upgrades, and proactive CVE response

Since February, Vercel has reported blocking 148 billion malicious requests from 108 million unique IP addresses. The company attributes the surge to a 70% quarter-over-quarter increase in mitigated WAF traffic and a 468% jump in unique source IPs, which it links to a sharp rise in globally distributed attack activity. These protections apply automatically to every deployment with no configuration required.

Where the traffic came from

The most significant volumes of malicious requests originated from the United States (55 billion), Ireland (29 billion), Singapore (7 billion), Hong Kong (5 billion), and Germany (3 billion). Australia, previously a top source, dropped out of the top five, reflecting shifting threat patterns across geographies. Vercel notes that the growth in both attack volume and unique IPs underscores the value of automatic global protections for keeping deployments secure by default.

Bot Filter enters public beta

The new Bot Filter is now in public beta and free for all users across every plan. It is a managed WAF ruleset that can be activated with a single click. Once enabled, it challenges non-browser bot traffic while allowing verified webhook providers such as Googlebot, Stripe, and PayPal, as well as internal cron jobs, to pass through uninterrupted.

Administrators can preview which requests the Bot Filter would block using log-only mode, which helps ensure application resources stay available for legitimate users while tuning the ruleset. Feedback on the beta can be submitted in the Vercel Community forum.

Faster Layer 7 DoS mitigation

Vercel has introduced Protectd, an update to its denial-of-service mitigation infrastructure. Protectd analyzes roughly 550,000 events per second globally, which accelerates the platform's ability to mitigate Layer 7 attacks. The result is a median mitigation time of 2.5 seconds and a P99 of approximately 3.5 seconds, allowing Vercel to block sophisticated attacks that traditional CDNs often miss. The system operates transparently, and all deployments immediately benefit without any configuration changes.

Framework vulnerability response

Vercel has taken proactive steps to harden its platform against several high-severity open-source framework vulnerabilities. In each case, protections were deployed without requiring manual customer intervention, though Vercel still recommends updating to the latest patched versions of affected packages.

  • CVE-2025-43864 and CVE-2025-43865 (React Router and Remix): Vercel deployed mitigations to the Vercel Firewall and purged potentially impacted caches to address cache poisoning denial of service and stored cross-site scripting attacks.
  • CVE-2025-31137 (React Router): The platform architecture prevented exposure to this URL manipulation vulnerability.
  • CVE-2025-29774 and CVE-2025-29775 (SAMLStorm): A security update to the Vercel Firewall mitigated this SAML authentication bypass risk.
  • CVE-2025-29927 and CVE-2025-30218 (Next.js middleware): While CVE-2025-29927 did not affect Vercel, analysis revealed a low-severity edge issue, CVE-2025-30218, which was patched and disclosed early to infrastructure provider partners.
  • MFA: Account security can be strengthened by adding a second factor with TOTP applications such as Google Authenticator or Authy, available alongside existing Passkeys.

Firewall usability and control updates

Several Firewall improvements have been rolled out to give teams more flexibility during active threats and deeper visibility into traffic patterns. Verified bots and cron jobs now bypass Attack Challenge Mode, so core operations like payments and analytics are not interrupted during a security incident.

Custom Firewall rules now support the logical OR operator in rule condition groups, which reduces configuration complexity for use cases with multiple conditions. System bypass rules have been expanded to apply to preview domains with increased limits, accommodating deployments that use external proxies. The Firewall dashboard now also includes IP enrichment: hovering over any IP address reveals ASN, location, and other metadata for faster investigation and control.

SDLC security documentation

Vercel has published a whitepaper, Secure every step of a modern SDLC, that documents how its built-in security features apply across the software development lifecycle, from planning and coding through deployment and monitoring. The resource is intended to simplify compliance discussions and streamline secure application development.