JA EN
shiichan

Cloudflare shields React and Next.js from a wave of new vulnerabilities!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hi everyone, it's Shii-chan! Today's a security heads-up about keeping your React and Next.js apps safe.

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog: React and Vercel disclosed several vulnerabilities in React Server Components and Next.js. They span a wide range - DoS, middleware/proxy bypass, SSRF, XSS, and cache poisoning - including CVE-2025-55184 and CVE-2026-23864.

In response, Cloudflare rolled out mitigations across both the WAF and its framework adapters.

Why it matters

React and Next.js are the foundation of countless web apps, so DoS, SSRF, or XSS landing there hits hard. Cloudflare puts it plainly:

We strongly recommend updating your application and its dependencies immediately.

The patched releases are React 19.0.6 / 19.1.7 / 19.2.6 and Next.js 15.5.16 / 16.2.5.

What changes

If you have Managed Rules enabled, two existing rules already block the DoS attacks by default. Cloudflare is also investigating extra coverage for three high-severity advisories.

Dive Deep

The framework adapters moved too:

You can track the WAF-side work in the WAF changelog.

Wrap-up

  • Multiple React and Next.js vulnerabilities (DoS, SSRF, XSS, and more) were disclosed.
  • With WAF Managed Rules enabled, existing rules block the DoS attacks by default.
  • Patched releases: the React 19.2.6 line and Next.js 15.5.16 / 16.2.5 - update your dependencies first!
  • This one's especially for anyone running React or Next.js on Cloudflare Workers.

Related posts