We’re excited to announce the availability of Adobe ColdFusion (2023 Release) Update 25, a significant update focused on platform modernization, developer productivity, improved compatibility, and important bug fixes across the server, Administrator, packages, and integrations.

The update also includes extensive OEM library upgrades, Query-of-Queries enhancements, metadata handling improvements, spread operator fixes, and updates to several ColdFusion packages.

Download the update

 

View the tech note

 

Release highlights

OEM upgrades

One of the biggest highlights in this release is the update of numerous underlying libraries and frameworks that power ColdFusion. Update 25 includes major upgrades to components such as:

  • Apache Maven 3.9.16
  • Log4j 2.25.4
  • Jetty 9.4.58
  • jQuery 3.7.1
  • Apache Tika 2.9.4
  • Commons libraries
  • Netty components
  • CXF services framework

These upgrades help improve compatibility, stability, maintainability, and overall platform security.

Query-of-Queries Enhancements

Developers who rely on Query-of-Queries (QoQ) will benefit from several important improvements.

Consistent NULL Evaluation for Varchar Columns

Previously, QoQ operations could return inconsistent results when evaluating IS NULL and IS NOT NULL predicates against varchar columns. The behavior could differ between varchar and numeric data types even when both contained equivalent NULL values.

Update 25 now provides:

  • Consistent NULL handling across varchar and integer columns
  • Reliable IS NULL filtering
  • Reliable IS NOT NULL filtering
  • Consistent behavior regardless of ColdFusion null support settings

This results in more predictable query processing and reduces edge-case issues in data-driven applications.

Improved Query Sorting Metadata

A long-standing edge case could cause datatype metadata corruption when sorting Query-of-Queries using fully qualified column names and subsequently adding new columns through queryAddColumn().

Update 25 preserves column type metadata correctly after sorting operations, ensuring that newly added varchar columns remain varchar and preventing DataTypeMismatchException errors.

 

Better Query Metadata Preservation

querySlice() Now Retains Column Types

Developers using querySlice() may have noticed that sliced queries occasionally lost original column type metadata.

For example:

  • Integer columns could lose integer metadata
  • Varchar columns could lose varchar metadata

With Update 25, the returned query now preserves the original query’s metadata, making serialization, type-sensitive processing, and framework integrations more reliable. Existing code requires no modifications to take advantage of the enhancement.

…and a lot more.. View the tech notes for more information.

We strongly recommend that all ColdFusion 2023 customers upgrade to Update 25 and review the latest security guidance and Lockdown recommendations as part of their update process.

Have questions about Update 25 or have feedback after upgrading? Join the discussion here on the Adobe ColdFusion Community Forum and let us know your experience.

Comments
(1)
Share
Priyank Shrivastava
I am working with ColdFusion Support team.
Staff 19 posts
Followers: 15 people
Follow
Priyank Shrivastava Follow
I am working with ColdFusion Support team.
Comments
(1)
Share
All Comments
Sort by:  Most Recent
  • Most Recent
  • Most Relevant
Charlie Arehart
2026-09-23 15:12:56

 

Folks (Adobe and other readers), here are some additional observations about this update–based solely on my reading the above and the technote (I’ve not yet applied the update, released this morning):

  • First, some will want to hear that no, there is no corresponding update released today for CF2025. In fact, much of what is in this update are things that were released on CF2025’s update 8. (Some will recall that when THAT update came out, there was also no corresponding update to CF2023.)
  • As a demonstration of that previous point, one can see that most of the “bugs fixed” listed in this update’s technote (linked to above) are in fact the same bugs listed as “bug fixes” in the CF2025 update 8 release notes. (There’s not a perfect match, but a very high correlation.)
  • That said, while update 8 of CF2025 had added MANY new features (AI and much more), you can see from the post above that this update has only a few feature changes (beyond the many library updates and bug fixes). So it’s NOT accurate to conclude that “this update brings CF2023 in line with CF2025 functionality”, but it does bring it “a bit more in line”.
  • It’s curious to see that while this post has a bit more info on these few qofq changes (null handling, sorting, queryslice/metadata), that same info is NOT offered in the cf2023 update 25 update technote. It merely mentions those words, not the additional detail offered here. It’s unfortunate that people seeing only the update technote won’t really be able to discern the changes unless they find this post.
  • Then again, this post currently ends that list of changes saying “…and a lot more” and pointing us to the update technote. But it only has “more” about bugs fixed, as far as I can tell. Again it has LESS detail about feature changes than this post.
  • FWIW, the update technote does indicate that 33 of the CF packages/modules are upgraded in this update. 
  • Finally, if anyone may conclude that it seems this update “has no security fixes for CF” (based on the indicated changes), that’s not quite accurate. Note how the post above says (after the list of upgrades to the various Java libraries that CF embeds): “These upgrades help improve compatibility, stability, maintainability, and overall platform security.” So this is indeed a “security update”, by that assocation.

 

It will be interesting to hear what other ramifications may come from folks applying the update. I don’t recall hearing much about the listed things when CF2025 update 8 was released, so hopefully this one goes smoothly for most folks.

 

Of course, if you may be skipping to update 25 from an update earlier than 24, then you do need to be aware of the changes brought by update 24 and any others you may have skipped. Those updates DID introduce sometimes-breaking changes, for the sake of security–and generally they offered an optional JVM arg that could be used to revert such changed behavior, to aid in migration (though such jvm args should not be relied on permanently, as they do revert improvements intended to increase security.)
Like