Changelog

Two-Factor Authentication (2FA) is now available. You can now secure your personal account using Two-Factor Authentication (2FA) with Time-based One-Time Passwords (TOTP)

In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability at the same time as two further reports from independent researchers.

Vercel's Attack Challenge Mode blocks attacks while securely allowing verified webhooks, search engines, and analytics tools.

Vercel's build cache now supports Yarn 2+ dependencies. Previously, dependencies were only cached for npm, pnpm, and Yarn 1.

Flags SDK 3.2 now supports precomputing pattern in SvelteKit, making it possible to use feature flags on static pages without causing layout shift or jank.

Track and analyze AI costs across models, providers, and users with Custom Reporting for Vercel AI Gateway. Tag requests, query spend by any dimension, and get full visibility into your AI usage, with no extra tools needed.

A security vulnerability in Next.js was responsibly disclosed, which allows malicious actors to bypass authorization in Middleware when targetting the x-middleware-subrequest header.

The newly released @flags-sdk/openfeature Flags SDK adapter for OpenFeature allows using any Node.js OpenFeature provider with the Flags SDK.