Current release: 6.4.2

The 6.4 release of Cequence Defender introduces agent identity verification for automated agent traffic, extends biometric step-up challenges to single-page applications, and automatically parameterizes shadow endpoints, alongside improvements to mitigation visibility and platform license compliance.

Changed behavior

In release 6.4.0, Defender's dependency footprint no longer includes LGPL-licensed backtrace libraries. Defender no longer captures a crash backtrace when the mitigator process fails unexpectedly.

When you diagnose a Defender crash, use the surrounding log entries and core dump instead of an inline backtrace.

New features

Release 6.4.0 adds the following capabilities.

Agent identity verification

Defender now verifies the identity of automated agents through signed tokens issued by supported agent identity providers, such as Skyfire. Configuration supports multiple token issuers at once, each with its own transport location, such as a header, cookie, or bearer token, and each with its own signing key delivered through a locally cached, automatically refreshed JSON Web Key Set (JWKS). JWT verification supports both RSA and EC signing keys, including ES256, and supports issuers that use a self-signed or internal certificate authority. After signature verification, Defender applies additional claim checks, such as token type, environment, and identity assertions. An automated agent request that is missing a required token, or that presents an invalid one on a protected route, now receives an HTTP 402 response instead of the standard browser challenge page.

Automatic parameterization of shadow endpoints

Defender now automatically parameterizes shadow endpoints using the same custom and system parameterization rules applied to documented endpoints. Disable this behavior when it does not fit your environment.

Additional mitigation and template enhancements

IP allowlist and denylist mitigation actions now report a correlation ID, giving full visibility into these actions on dashboards and in metrics. Custom HTML block-page templates can now include a timestamp key that shows when the block occurred.

Active upstream health checks

Defender now performs active health checking on upstream origins, extending the existing passive monitoring with real-time probing for both standard and alternate-origin upstreams. Health checking correctly detects an origin outage, fails over, and recovers, including across a routine configuration reload. This capability is available behind a configuration flag, disabled by default, and covers monitoring and status reporting only. Alert and metric support is planned as a follow-up.

Notice regarding nginx version

After reviewing Cequence Defender's exposure to CVE-2026-42533, a critical heap buffer overflow in nginx's regex-based map directive, Defender's default configuration does not use a regex map directive, so a standard deployment does not meet the vulnerability's trigger condition. This release does not change Defender's bundled nginx version. Deployments that add a custom regex-based map directive with numbered capture variables, through the customer-extensible map configuration, remain in the affected version range and should contact Cequence support for guidance.

New Apigee Hybrid passive integration (beta)

A beta release of a new passive integration for Apigee Hybrid is available. The integration uses Apigee's Shared Flow feature to capture request and response data at the pre-proxy and post-target hooks, and forwards it to Cequence Bridge. Traffic is not affected when Cequence Bridge is unreachable. A new command-line utility automates deployment, verification, and removal of the integration, in addition to the existing manual installation steps. The integration also supports optional rate limiting of the traffic sent to Cequence Bridge. This integration requires Cequence Bridge release 6.3.4 or later. Contact Cequence support for beta access.

Fixed issues

The 6.4 release also includes the following fixes.

Release 6.4.2

DEF-2299: Fixes an issue in which the Defender 6.4.1 image shipped with an nginx build that did not support upstream health checking.

Release 6.4.1

Message data flowing from the backplane to the Cequence Platform dashboards is now compressed.

Status code metrics are now exposed using Prometheus.

Release 6.4.0

Defender's URI parameterization now produces the correct path when a lookahead rule's anchor segment repeats in the request URI

DEF-2146: IP allowlist and denylist actions are now tagged with a correlation ID in the sensor log instead of appearing as an unmatched request

DEF-2148: The block page and the Mitigation dashboard now display the same transaction ID for a given request

Defender no longer crashes when overlapping IP address ranges are removed from an IP data set

Defender no longer restarts a worker process when a session cookie contains a malformed JSON Web Token (JWT)

Defender no longer writes OAuth2 access tokens to application logs

Traffic statistics no longer overcount transactions because of duplicate telemetry records generated during data delivery

DEF-2188: Defender's mitigation policy cache now reliably becomes ready at startup, preventing repeated restarts under Kubernetes liveness checks

Defender no longer loses sensor transaction logs when nginx reloads while requests are in flight

Mitigation policy conditions now evaluate every occurrence of a repeated request header individually

Endpoint threat classification now reports a consistent result for identical allowlisted IP traffic, regardless of whether the request has a body

Defender no longer restarts its entire policy-store startup sequence when a single store is temporarily unavailable

Defender containers now honor an operator-supplied NO_PROXY value instead of overwriting it at startup

DEF-2222: Data extractions now run correctly on mitigated (blocked) requests

The TCP HSL reader no longer reports decode errors for the trailing framing bytes that the Apigee X integration appends to each transaction

Defender now applies and reports mitigation actions correctly when a request body fails to complete

DEF-2230: Defender no longer duplicates block-action response headers, such as Access-Control-Allow-Origin, across repeated configuration reloads

The default ignore-extensions matching now requires a literal dot before the file extension

Defender no longer leaks memory when a mitigation policy blocks a POST request with an empty body while a body dynamic fingerprint (FPv2) algorithm is enabled