Current release: 6.4.0
The 6.4 release of Cequence Defender introduces agent identity verification for automated agent traffic, extends biometric step-up challenges to single-page applications, and automatically parameterizes shadow endpoints, alongside improvements to mitigation visibility and platform license compliance.
Changed behavior
In release 6.4.0, Defender's dependency footprint no longer includes LGPL-licensed backtrace libraries. Defender no longer captures a crash backtrace when the mitigator process fails unexpectedly.
When you diagnose a Defender crash, use the surrounding log entries and core dump instead of an inline backtrace.
New features
Release 6.4.0 adds the following capabilities.
Agent identity verification
Defender now verifies the identity of automated agents through signed tokens issued by supported agent identity providers, such as Skyfire. Configuration supports multiple token issuers at once, each with its own transport location, such as a header, cookie, or bearer token, and each with its own signing key delivered through a locally cached, automatically refreshed JSON Web Key Set (JWKS). JWT verification supports both RSA and EC signing keys, including ES256, and supports issuers that use a self-signed or internal certificate authority. After signature verification, Defender applies additional claim checks, such as token type, environment, and identity assertions. An automated agent request that is missing a required token, or that presents an invalid one on a protected route, now receives an HTTP 402 response instead of the standard browser challenge page.
Automatic parameterization of shadow endpoints
Defender now automatically parameterizes shadow endpoints using the same custom and system parameterization rules applied to documented endpoints. Disable this behavior when it does not fit your environment.
Additional mitigation and template enhancements
IP allowlist and denylist mitigation actions now report a correlation ID, giving full visibility into these actions on dashboards and in metrics. Custom HTML block-page templates can now include a timestamp key that shows when the block occurred.
Active upstream health checks
Defender now performs active health checking on upstream origins, extending the existing passive monitoring with real-time probing for both standard and alternate-origin upstreams. Health checking correctly detects an origin outage, fails over, and recovers, including across a routine configuration reload. This capability is available behind a configuration flag, disabled by default, and covers monitoring and status reporting only. Alert and metric support is planned as a follow-up.
Notice regarding nginx version
After reviewing Cequence Defender's exposure to CVE-2026-42533, a critical heap buffer overflow in nginx's regex-based map directive, Defender's default configuration does not use a regex map directive, so a standard deployment does not meet the vulnerability's trigger condition. This release does not change Defender's bundled nginx version. Deployments that add a custom regex-based map directive with numbered capture variables, through the customer-extensible map configuration, remain in the affected version range and should contact Cequence support for guidance.
New Apigee Hybrid passive integration (beta)
A beta release of a new passive integration for Apigee Hybrid is available. The integration uses Apigee's Shared Flow feature to capture request and response data at the pre-proxy and post-target hooks, and forwards it to Cequence Bridge. Traffic is not affected when Cequence Bridge is unreachable. A new command-line utility automates deployment, verification, and removal of the integration, in addition to the existing manual installation steps. The integration also supports optional rate limiting of the traffic sent to Cequence Bridge. This integration requires Cequence Bridge release 6.3.4 or later. Contact Cequence support for beta access.
Fixed issues
Release 6.4.0 also includes the following fixes.
Defender's URI parameterization now produces the correct path when a lookahead rule's anchor segment repeats in the request URI
DEF-2146: IP allowlist and denylist actions are now tagged with a correlation ID in the sensor log instead of appearing as an unmatched request
DEF-2148: The block page and the Mitigation dashboard now display the same transaction ID for a given request
Defender no longer crashes when overlapping IP address ranges are removed from an IP data set
Defender no longer restarts a worker process when a session cookie contains a malformed JSON Web Token (JWT)
Defender no longer writes OAuth2 access tokens to application logs
Traffic statistics no longer overcount transactions because of duplicate telemetry records generated during data delivery
DEF-2188: Defender's mitigation policy cache now reliably becomes ready at startup, preventing repeated restarts under Kubernetes liveness checks
Defender no longer loses sensor transaction logs when nginx reloads while requests are in flight
Mitigation policy conditions now evaluate every occurrence of a repeated request header individually
Endpoint threat classification now reports a consistent result for identical allowlisted IP traffic, regardless of whether the request has a body
Defender no longer restarts its entire policy-store startup sequence when a single store is temporarily unavailable
Defender containers now honor an operator-supplied NO_PROXY value instead of overwriting it at startup
DEF-2222: Data extractions now run correctly on mitigated (blocked) requests
The TCP HSL reader no longer reports decode errors for the trailing framing bytes that the Apigee X integration appends to each transaction
Defender now applies and reports mitigation actions correctly when a request body fails to complete
DEF-2230: Defender no longer duplicates block-action response headers, such as Access-Control-Allow-Origin, across repeated configuration reloads
The default ignore-extensions matching now requires a literal dot before the file extension
Defender no longer leaks memory when a mitigation policy blocks a POST request with an empty body while a body dynamic fingerprint (FPv2) algorithm is enabled