Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Starting with cloudflared 2026.11.0, Tunnel handles semicolon-delimited path parameters before matching ingress rules.
- Cloudflare limits the stated impact to Tunnel rules that require Access validation; configurations without those rules are unaffected.
- The setting is off by default today. New cloudflared releases from 8 February 2027 are planned to enable it by default, replacing 25 January.
- The URL path sent to the origin remains unchanged. Compare the ingress match, Access-validation result and path received by the origin.
Separate the available version from its default
In its 12 November 2026 update, Cloudflare said Cloudflare Tunnel will handle semicolon-delimited path parameters before matching ingress rules, starting with version 2026.11.0 of the cloudflared Tunnel connector. This extends the URL normalization introduced in 2026.10.0. The notice describes path handling at the matching stage; it does not say that every Tunnel route will change.
The setting is currently off by default. Cloudflare plans for new cloudflared releases starting 8 February 2027 to enable URL normalization by default, moving the previously announced date from 25 January. This is a planned default for new releases, not evidence that the behavior is already enabled in your environment.
Check which rules require Access validation
Cloudflare limits the stated impact to Tunnel configurations with rules that require Access validation. It says configurations without such rules are unaffected. Start with the ingress rules you actually use, identify the ones that require Access validation, and then decide whether they need a dedicated test. Do not treat every Tunnel as affected.
Because the path parameters are normalized before rule matching, requests containing semicolon-delimited parameters deserve a check against the expected ingress and Access results. The notice is specific to this path behavior; it does not claim that all URL encodings, query parameters or origin processing are changing.
Test rule matching separately from the origin path
Cloudflare explicitly says the URL path sent to the origin stays the same. Record two observations separately during a test: which Tunnel ingress rule matched and which path the origin ultimately received. This keeps a change in matching logic from being mistaken for a rewrite of the origin path.
If the result differs after enabling normalization, first compare the running cloudflared version, the relevant ingress rules and the Access-validation result, then check the origin-side record. A response status alone does not identify which layer changed, and it is not evidence that Cloudflare announced an origin-path change.
Test the ingress rules you actually run
Start with the cloudflared version in use and an inventory of Tunnel rules. Select rules that require Access validation, then use an authorized isolated environment with representative requests that contain semicolon-delimited path parameters. Compare the current default behavior with the result after enabling the new normalization.
Use the allow and deny checks from your existing Access policy. Verify the expected ingress rule, whether Access validation ran and the path observed by the origin. Record the version, rule, setting on each participating replica and result. Keep test traffic and temporary exceptions out of production rules.
Choose whether to opt in within an authorized environment
To try the change before the planned date, Cloudflare provides two explicit options: use the CLI flag --disable-path-normalization=false, or set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each cloudflared replica and restart it. The environment-variable method is per replica; in a multi-replica test, make sure the record covers every replica involved.
If you are not opting in early, continue to check the releases in your own upgrade process. Before adopting a cloudflared release published from 8 February 2027 onward, test rules that require Access validation and contain semicolon-delimited path parameters, and keep a clear rollback plan for configuration changes.
Sources
Frequently Asked Questions
Did Cloudflare name the first cloudflared release that will use the new default?
No. The notice gives a date for the default behavior in new releases starting 8 February 2027, but it does not name a specific release. Check the release notes and actual default for the version you plan to adopt.
Will existing Tunnels upgrade automatically on 8 February 2027?
The notice describes a default for new releases from that date; it does not say that accounts will be upgraded automatically or that existing deployments will be forced to migrate. Check the cloudflared version you run and your own upgrade process.