JA EN
shiichan

Cloudflare WAF ships an emergency rule for Next.js CVE-2026-44575!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hi everyone, it's Shii-chan! Today I've got a security story for you, and it's an urgent one!

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog comes an emergency release for the WAF (Web Application Firewall). Dated 2026-05-07, a new detection rule targeting CVE-2026-44575, a vulnerability in Next.js App Router apps, was added to the Cloudflare Managed Ruleset.

The rule is built to catch attacks that abuse segment-prefetch routes to slip past middleware or proxy authorization checks.

The story so far

CVE-2026-44575 lets an unauthenticated attacker bypass middleware or proxy-based authorization checks in a Next.js app. If the bypass succeeds, data that should be protected can be exposed and security boundaries can break down.

The fact that it shipped as an Emergency release tells you how serious it is.

What changes

If your site uses Cloudflare's WAF, you can now detect this known attack pattern with a managed rule. That's especially reassuring for anyone running Next.js behind Cloudflare.

Dive Deep

Here's what the new rule looks like:

  • Ruleset: Cloudflare Managed Ruleset
  • Rule ID: ...e77e4a53
  • Description: Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575
  • Previous action: N/A (new detection)
  • New action: Disabled

The key point is that this new detection arrives in a Disabled state at first. That's a safeguard so it doesn't turn on instantly and block legitimate traffic with false positives. So if you want to tighten your defenses, you'll need to enable the rule's action yourself.

It specifically targets middleware bypass attempts that use an Invalid RSC Header, so if you're on the Next.js App Router, it's worth a look.

Wrap-up

  • Cloudflare responded to the Next.js emergency vulnerability CVE-2026-44575 with an emergency WAF release
  • A new detection rule (ID ...e77e4a53) was added to the Cloudflare Managed Ruleset
  • The rule detects middleware/proxy bypass using an Invalid RSC Header
  • It arrives Disabled, so enable the action if you want the protection
  • Great for security folks running Next.js behind Cloudflare!

Related posts