compare
Anubis vs Coraza
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Anubis | Coraza |
|---|---|---|
| Language | Go | Go |
| Licence | MIT | Apache-2.0 |
| Stars | 23k | 3.9k |
| Latest | v1.27.0 | v3.8.1 |
| Last push | 2026-10-05 | 2026-10-06 |
| Release cadence | too few releases | about 5 days between releases |
| Active contributors | 27 commit authors on the default branch in the last 90 days | 8 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace Cloudflare WAF. Alternatives to Cloudflare WAF →
PartialAnubisOnly the bot challenge: a proof-of-work check in front of a site to keep scrapers out.
PartialCorazaWAF library in Go, compatible with ModSecurity rules, embedded in Caddy, Envoy or your own proxy.
Anubis
- v1.28.0-pre22026-09-17v1.28.0-pre2: Wuk Lamatpre-release
- v1.28.0-pre12026-08-30v1.28.0-pre1: Wuk Lamatpre-release
- v1.27.02026-08-08v1.27.0: Moenbryda Wilfsunnwyn
- v1.27.0-pre42026-08-07v1.27.0-pre4: Moenbryda Wilfsunnwynpre-release
- v1.27.0-pre32026-08-05v1.27.0-pre3: Moenbryda Wilfsunnwynpre-release
Coraza
- v3.8.12026-10-02Coraza v3.8.1 is a security release. It completes several fixes that shipped in v3.8.0 and fixes a process crash. All u…
- v3.8.02026-09-30| Advisory | Severity | Affected | Summary |
- v3.7.02026-04-06feat: implement audit log Part J (uploaded files)
- v3.6.02026-03-31perf: optimize @rx operator with literal pre-filtering
- v3.5.02026-03-28feat: enable regex memoize by default
Anubis
unsigned The latest release, v1.27.0, carries no signature GitHub could verify.
Loading the security report
Coraza
✓ signed The latest release, v3.8.1, carries a signature GitHub verified.
Loading the security report