Starting from version 2026.11.0, Cloudflare Tunnel extends the URL normalization introduced in 2026.10.0. Normalization now handles semicolon-delimited path parameters before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same.
Starting 2027-02-08, new cloudflared releases will turn on URL normalization by default. This replaces the previously announced date of 2027-01-25, giving you time to test the updated behavior. Upgrade to version 2026.11.0 or later and test your path-based routing before that date, including rules that match paths containing semicolons. Configurations without rules requiring Access validation are unaffected.
This setting is currently off by default. To turn it on, run:
cloudflared tunnel --disable-path-normalization=false run <TUNNEL_NAME_OR_UUID>Alternatively, set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each cloudflared replica and restart it.
For more information, refer to ingress matching and Access validation at the origin.
Source: Cloudflare
