Vercel security roundup: improved bot defenses, DoS mitigations, and insights

Vercel blocked 148 billion malicious requests between February and May, a 70% increase quarter over quarter, coming from 108 million unique IP addresses (up 468%). The largest volumes came from the United States (55 billion), Ireland (29 billion), Singapore (7 billion), Hong Kong (5 billion) and Germany (3 billion); Australia, previously in the top five, dropped out. These protections apply automatically to every deployment, alongside several new tools announced in this security roundup.

• Bot Filter is now in public beta, free on all plans. It's a one-click managed WAF ruleset that challenges non-browser bot traffic while allowing verified sources like Googlebot, Stripe, PayPal and internal cron jobs through. A log-only mode lets teams preview what it would block before turning it on.
• Protectd, an update to Vercel's DoS mitigation infrastructure, analyzes around 550,000 events per second globally and brings median Layer 7 attack mitigation time to 2.5 seconds (P99 around 3.5 seconds), with no configuration required.
• Vercel says it proactively mitigated several high-severity CVEs at the platform level, including React Router/Remix cache-poisoning and XSS bugs (CVE-2025-43864, CVE-2025-43865), the SAMLStorm authentication bypass (CVE-2025-29774, CVE-2025-29775), and a Next.js middleware issue it identified and patched itself (CVE-2025-30218). Accounts can now add TOTP-based multi-factor authentication alongside Passkeys.
• Firewall updates include letting verified bots and cron jobs bypass Attack Challenge Mode, an OR operator for custom Firewall rules, expanded system bypass rules for preview domains, and IP enrichment (ASN, location) on hover in the Firewall dashboard.

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

View Vercel →

Original source