All blog posts
Page 5 of 50
-
A Smarter ACME Challenge for a Multi-CDN World
Optimize your multi-CDN setup with Fastly's new dns-account-01 ACME challenge. Eliminate label collisions and enhance certificate management.
-
The CDN Showdown: Fastly Outpaces Akamai in Real-World Performance
As user expectations rise and milliseconds define outcomes, choosing a modern, high-speed CDN is no longer optional but a strategic imperative. Independent Google data shows Fastly consistently outperforms Akamai in real-world web performance.
-
Make Sense of Chaos with Fastly API Discovery
Discover, monitor, and secure your APIs with Fastly API Discovery. Get instant visibility, cut the noise, and keep your APIs secure and compliant.
-
CISO Perspective: Q2 2025 Threat Insights Report
Explore Fastly's Q2 2025 Threat Report through our CISO, Marshall Erwin's eyes. Uncover bot traffic insights and key security practices.
-
Request Collapsing Demystified
Boost website performance with request collapsing! Learn how it improves efficiency, reduces origin load, and optimizes caching for a snappy user experience.
-
Teach Your robots.txt a New Trick (for AI)
Control how AI bots like Google-Extended and Applebot-Extended use your website content for training. Update your robots.txt file with simple Disallow rules.
-
Fastly + Scalepost: Extending the Fastly platform to manage AI Crawlers
See when and how AI chatbots use your content. With Fastly and ScalePost, publishers finally gain visibility into how their work shows up in AI-generated answers.
-
Control and Monetize Your Content with the RSL Standard
AI crawlers are scraping the web, often ignoring rules and costing publishers resources. The new RSL Standard lets you block, allow, or even charge AI for access to your content. Here’s how it works.
-
OS Command Injection Explained
In this blog, we'll explore the web application vulnerability, OS Command Injection, and how to prevent it.
-
4 Tips for Developers for Using Fastly’s Sustainability Dashboard
Track the real-world emissions of your Fastly workloads. This blog shares practical tips on using the Sustainability dashboard for greener, faster code.
-
The Tools Gap: Why Developers Struggle to Code Green
77% of developers want to code sustainably, but most lack the tools to measure impact. Fastly’s survey reveals the barriers and opportunities in green coding.
-
Vulnerability in modern processors
On Wednesday, January 3rd, research was published on a class of security vulnerabilities affecting specific processors. These vulnerabilities could allow a user who can execute code on a system to gain unauthorized access to information across security boundaries. Fastly has completed initial analysis of these vulnerabilities and does not believe they pose an immediate threat to Fastly customers.
-
Request body disclosure to other Fastly services
From August 31st through November 4th, Fastly deployed a version of Varnish which contained a security bug that, in a limited and non-standard set of configurations, disclosed request bodies to other customer origins. In these cases, a request body sent to an affected Fastly customer's service would have been included in a malformed request to a different customer's origin, which may have been logged in that origin web server's access logs. Fastly performed a comprehensive assessment to identify customers most likely to be affected by this issue. These customers have been contacted directly by Fastly Customer Engineering.
-
Vulnerability in use of HTTP_PROXY by CGI
On Monday, July 18, 2016, security researchers published information on a vulnerability in the handling of the HTTP_PROXY environment variable by specific Common Gateway Interface (CGI) scripts. While this vulnerability does not affect Fastly, web servers used as origins may run a variety of scripts, some of which may be vulnerable. This Security Advisory provides guidance to customers on how they can protect origin servers from attacks.
-
Use After Free flaw in Lucet-runtime
On November 11th 2021, Fastly Engineering received alerts related to segmentation faults on Compute@Edge. A Fastly investigation into CVE-2021-43790, a bug in Lucet, a dependency of Compute@Edge, is disclosed in a recent Bytecode Alliance security advisory. Fastly investigations have not identified additional impact outside of the single case disclosed in this advisory. It's our goal in this Fastly Security Advisory to illustrate our knowledge about the bug discovered and the actions we have taken to prevent further possible impact to our customers.
-
Cache Poisoning Leveraging Various X-Headers
On Thursday, August 9th, research was published at Black Hat USA 2018 on cache poisoning attacks against websites deployed behind caching infrastructure. These attacks could allow an attacker to inject arbitrary content into a victim’s cache. Fastly service configurations that do not take into consideration the interaction between headers that backends use to select content may be vulnerable. This risk can be fully mitigated via a VCL patch or by modifying backend configurations.
-
Vulnerability in Linux Kernel TCP implementation
On August 6, 2018, a vulnerability in the Linux kernel TCP implementation, called SegmentSmack, was publicly disclosed. This vulnerability allowed a remote attacker to cause a denial-of-service attack on a target server by simply establishing a TCP connection to the server and sending specific segments over the connection. Fastly has worked with the security community in advance of this disclosure to address this vulnerability in our edge networks. They pose no threat to Fastly customers.
-
CVE-2015-7547 Buffer Overflow in glibc
On Tuesday, February 16th, researchers published details about a new vulnerability in the glibc library, a standard C library. The vulnerability existed in the code used to translate hostnames into IP addresses. Processes that use it are very common across network service providers, such as CDNs. Fastly immediately implemented a security update on affected systems. No customer action is required. Fastly’s service was not impacted.
-
DROWN Attack & Fastly
Today in conjunction with an OpenSSL Security Advisory several researchers announced a new attack on HTTPS they are calling “Decrypting RSA with Obsolete and Weakened Encryption,” or DROWN. Due to Fastly’s existing TLS configuration, our services, and customers using Fastly as their CDN, are not vulnerable to this attack.
-
Resolved: Fastly “forward secrecy” vulnerability
On Monday, November 14, 2016, security researchers published a paper “Measuring the Security Harm of TLS Crypto Shortcuts.” Among other findings across the TLS implementation of several sites, the paper identified Fastly as not frequently rotating TLS session tickets, limiting the effectiveness of forward secrecy. While Fastly was not directly contacted by the researchers, Fastly had previously been made aware of the issue, and this vulnerability was addressed on Friday, November 11. No customer action is required to benefit from the fix.
