JA EN
shiichan

Cloudflare One Client for Windows 2026.8.2100.0 Is GA, Better with Huge Hosts Files

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hi, it's Shii-chan! The Windows Cloudflare One Client has a new GA release too.

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, version 2026.8.2100.0 of the Windows Cloudflare One Client was released. It is a GA release available on the stable releases downloads page.

The story so far

Traffic to split tunnel excluded resources could be briefly blocked while the client was connecting or reconnecting. Devices with very large hosts files could also have connection reliability problems.

What changes

The highlights:

  • Traffic to split tunnel excluded resources is no longer briefly blocked while connecting or reconnecting
  • The learned split tunnel configuration is kept across tunnel reconnections
  • Non-RFC 1918 local IPv4 networks can be routed through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM
  • The client detects a large hosts file, allows more time for its initial DNS check, and shows a banner that connecting may take longer
  • The hosts file is read once and shared across DNS resolvers, so reconnects are faster and memory use is lower
  • A service recovery mechanism backed by a Windows scheduled task starts the client service on system unlock if it isn't running (enabled by default)

Dive Deep

Other improvements:

  • More reliable reauthentication, and a fix for reauthentication forcing a new registration
  • Better reaction when the current network lowers its MTU
  • TCP MSS clamping for DNS-over-HTTPS through the tunnel, improving DNS reliability on low-MTU networks
  • Individual DNS-over-HTTPS queries time out instead of hanging
  • API requests dropped on reused pooled connections are retried
  • A new MDM setting prefers IPv4 when resolving hostnames in proxy mode (off by default)
  • The client no longer requires the Windows WLAN AutoConfig service

Key fixes:

  • No reconnecting during Emergency Disconnect after switching organizations or re-registering
  • The client can connect after an upgrade even when stored registration credentials don't match its configuration
  • No unexpected service restarts when the service is slow, such as after waking from sleep, and the service restarts correctly after an unexpected termination
  • The UI no longer gets stuck connecting after sleep and wake when the tunnel is connected
  • Slow captive portal checks no longer make the service unresponsive or cause restarts
  • Fixed a race on key rotation that could stop WireGuard from connecting
  • Fixed "No network" after a successful manual disconnect
  • DEX HTTP tests no longer fail TLS validation
  • Resolved latency spikes and traffic interruptions during TPM-backed API authentication with hardware-backed registration
  • Trailing whitespace in BIOS serial numbers no longer breaks serial-number and client-certificate posture checks
  • The UI no longer crashes at startup when it cannot write to the Windows registry
  • Fixed a UI crash when the daemon connection resets, and a startup crash when locale date formatting data hasn't loaded

Known issue: a Windows DNS client regression may cause connectivity check failures on systems with large hosts files. This release mitigates it, but you may still see reduced DNS performance and check failures.

Wrap-up

  • Windows Cloudflare One Client 2026.8.2100.0 is GA
  • No more brief blocking, and split tunnel settings persist across reconnects
  • Large hosts file handling and a scheduled-task service recovery were added
  • Many fixes around TPM authentication and posture checks
  • Known issue: a Windows DNS client regression with large hosts files

This is for admins deploying the Cloudflare One Client to Windows devices!

Related posts