Wrangler Deploy Error: Received a malformed response from the API

[pierrekin]

What versions & operating system are you using?

wrangler 4.80.0, bun 1.3.11, macOS Tahoe 26.4 (25E246)

Please provide a link to a minimal reproduction

not applicable

Describe the Bug

When deploying using bunx wrangler deploy I get an error indicating an unexpected HTML response from the cloudflare API.

I monkey patched Wrangler to see the full HTML page, and noticed the following:

✘ [ERROR] Received a malformed response from the API
...
          <h1 data-translate="block_headline">Sorry, you have been blocked</h1>
          <h2 class="cf-subheadline"><span data-translate="unable_to_access">You are unable to
  access</span> api.cloudflare.com</h2>

I.e. the Cloudflare WAF on api.cloudflare.com is blocking my request.

This is a false positive, I am a normal user, not doing any kind of security research and simply trying to deploy my worker.

Cloudflare Ray ID: 9e8116df4823e2c5

Please provide any relevant error logs

bunx wrangler deploy --env production

 ⛅️ wrangler 4.80.0
───────────────────
▲ [WARNING] You are about to publish a Workers Service that was last updated via the script API.

  Edits that have been made via the script API will be overridden by your local code and config.


✔ Would you like to continue? … yes

🌀 Building list of assets...
✨ Read 14 files from the assets directory [redacted]
🌀 Starting asset upload...
No updated asset files to upload. Proceeding with deployment...
Total Upload: 4.64 KiB / gzip: 1.87 KiB
Your Worker has access to the following bindings:
Binding                                                              Resource
[redacted]
✘ [ERROR] Received a malformed response from the API
[redacted]
...
  POST /accounts/[redacted]/workers/scripts/[redacted]/versions ->
  403 Forbidden

  If you think this is a bug, please open an issue at:
  https://github.com/cloudflare/workers-sdk/issues/new/choose

[pierrekin]

An update, I noticed that when including a particular shell script in my bundle, I got this behaviour, when removing the shell script the behaviour went away.

I consider this a bug in the CF WAF but I do admit the script does seem pretty suspicious (curl | bash install instructions etc).

I still consider this a bug in wrangler either way (broken handling of the WAF response).

[dario-piotrowicz]

Thanks for the issue @pierrekin 🙂

I've opened #13574 to better address the WAF response handling for this specific error (unfortunately a generic handling solution is not really possible)

I can also send the issue to the WAF team so that they can check and see if they can also fix the handling on their end, but in order to do that I'd need a fresh ray ID from you, any chance you could generate a new one? 🙏

[pierrekin]

Thanks for following up @dario-piotrowicz,

I am not able to trigger this issue anymore and get you a new Ray ID. Sorry about that.