Cloudflare changelogs | Workers VPC

Workers VPC - Reach Cloudflare WAN destinations from Workers VPC

Thu, 21 May 2026 00:00:00 GMT

You can now use VPC Network bindings with network_id: "cf1:network" to reach your full private network from Workers, including:

Cloudflare Mesh nodes and client devices
Subnet routes and hostname routes announced through Cloudflare Tunnel or Cloudflare Mesh
Destinations connected through Cloudflare WAN on-ramps — GRE, IPsec, and CNI

This means a single VPC Network binding can route Worker requests to private services regardless of how those services are connected to Cloudflare: through a Cloudflare Tunnel from a cloud VPC, a Mesh node on a private subnet, or a Cloudflare WAN on-ramp from your data center or branch site.

wrangler.jsonc

{
  "vpc_networks": [
    {
      "binding": "PRIVATE_NETWORK",
      "network_id": "cf1:network",
      "remote": true,
    },
  ],
}

wrangler.toml

[[vpc_networks]]
binding = "PRIVATE_NETWORK"
network_id = "cf1:network"
remote = true

At runtime, the URL you pass to fetch() determines the destination:

// Reach a service behind a Cloudflare WAN IPsec on-ramp
const response = await env.PRIVATE_NETWORK.fetch("http://10.50.0.100:8080/api");

For configuration options, refer to VPC Networks.

Workers VPC - VPC Networks and Cloudflare Mesh support now in public beta

Tue, 14 Apr 2026 00:00:00 GMT

VPC Network bindings now give your Workers access to any service in your private network without pre-registering individual hosts or ports. This complements existing VPC Service bindings, which scope each binding to a specific host and port.

You can bind to a Cloudflare Tunnel by tunnel_id to reach any service on the network where that tunnel is running, or bind to your Cloudflare Mesh network using cf1:network to reach any Mesh node, client device, or subnet route in your account:

wrangler.jsonc

{
  "vpc_networks": [
    {
      "binding": "MESH",
      "network_id": "cf1:network",
      "remote": true
    }
  ]
}

wrangler.toml

[[vpc_networks]]
binding = "MESH"
network_id = "cf1:network"
remote = true

At runtime, fetch() routes through the network to reach the service at the IP and port you specify:

const response = await env.MESH.fetch("http://10.0.1.50:8080/api/data");

For configuration options and examples, refer to VPC Networks and Connect Workers to Cloudflare Mesh.

Workers VPC - Observability for Workers VPC Services

Fri, 20 Mar 2026 00:00:00 GMT

Each VPC Service now has a Metrics tab so you can monitor connection health and debug failures without leaving the dashboard.

Connections — See successful and failed connections over time, broken down by what is responsible: your origin (Bad Upstream), your configuration (Client), or Cloudflare (Internal).
Latency — Track connection and DNS resolution latency trends.
Errors — Drill into specific error codes grouped by category, with filters to isolate upstream, client, or internal failures.

You can also view and edit your VPC Service configuration, host details, and port assignments from the Settings tab.

For a full list of error codes and what they mean, refer to Troubleshooting.

Workers VPC - Origin CA certificate support for Workers VPC

Fri, 13 Feb 2026 00:00:00 GMT

Workers VPC now supports Cloudflare Origin CA certificates when connecting to your private services over HTTPS. Previously, Workers VPC only trusted certificates issued by publicly trusted certificate authorities (for example, Let's Encrypt, DigiCert).

With this change, you can use free Cloudflare Origin CA certificates on your origin servers within private networks and connect to them from Workers VPC using the https scheme. This is useful for encrypting traffic between the tunnel and your service without needing to provision certificates from a public CA.

For more information, refer to Supported TLS certificates.

Workers VPC - Announcing Workers VPC Services (Beta)

Wed, 05 Nov 2025 00:00:00 GMT

Workers VPC Services is now available, enabling your Workers to securely access resources in your private networks, without having to expose them on the public Internet.

What's new

VPC Services: Create secure connections to internal APIs, databases, and services using familiar Worker binding syntax
Multi-cloud Support: Connect to resources in private networks in any external cloud (AWS, Azure, GCP, etc.) or on-premise using Cloudflare Tunnels

export default {
  async fetch(request, env, ctx) {
    // Perform application logic in Workers here

    // Sample call to an internal API running on ECS in AWS using the binding
    const response = await env.AWS_VPC_ECS_API.fetch("https://internal-host.example.com");

    // Additional application logic in Workers
    return new Response();
  },
};

Getting started

Set up a Cloudflare Tunnel, create a VPC Service, add service bindings to your Worker, and access private resources securely. Refer to the documentation to get started.