JA EN
shiichan

Next.js Just Got 2 Critical RCE Vulnerabilities — Cloudflare's Emergency WAF Rules Block Them Instantly!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#web

Hey everyone, it's me, Shii-chan! No time to relax today — I've got an urgent security update for you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, an emergency WAF release dated August 26, 2026 was announced. This update to the Managed Ruleset addresses two remote code execution (RCE) vulnerabilities in Next.js.

Here are the two vulnerabilities covered:

  • CVE-2026-75604 — affects Next.js applications hosted on Windows (both the Pages Router and the App Router, when Cache Components isn't used). It allows unauthenticated remote code execution
  • GHSA-2xp9-vwfh-vxw4 — affects the Next.js Image Optimizer. Getting it to optimize a crafted AVIF image can trigger unauthenticated remote code execution

Next.js recommends upgrading to version 16.3.3 or 15.5.24 to address these issues.

Why it matters

Next.js is used by web apps all over the world, so an unauthenticated RCE vulnerability in it has a very wide blast radius. What makes this batch especially unsettling is that there are two issues at once, and one of them turns an innocuous-looking feature — image optimization — into an attack vector.

Patching an application can take time, so Cloudflare pushed out WAF-side protection first, so attack attempts can be blocked before every affected app gets patched.

What changes

If your Next.js site sits behind Cloudflare's Managed Ruleset, you get the benefit of this rule update with no extra configuration. Malicious requests get blocked at the WAF before they ever reach your app.

That said, WAF protection is a safety net, not a substitute — you'll still want to upgrade Next.js itself for the real fix.

Dive Deep

This release updates or adds two rules inside the Cloudflare Managed Ruleset:

  • Existing rule (ID ending in 2ca6cce3): the description for "Next.js - Remote Code Execution - CVE:CVE-2026-75604" was updated to explicitly reference CVE-2026-75604. It was already set to Block, and the underlying detection logic is unchanged
  • New rule (ID ending in 80256efe): "Next.js - Image Optimizer Remote Code Execution via Crafted AVIF" is a brand-new rule detecting attacks via crafted AVIF images, enabled with a Block action

In other words, attacks against the Image Optimizer using crafted AVIF images are now blocked at the WAF level for the first time.

Wrap-up

  • Cloudflare shipped an emergency WAF release covering two Next.js RCE vulnerabilities (CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4)
  • The existing rule's description was updated to explicitly name the CVE (detection itself is unchanged)
  • A new Block rule was added for Image Optimizer attacks via crafted AVIF images
  • The real fix still requires upgrading Next.js to 16.3.3 or 15.5.24

If you're running Next.js behind Cloudflare's WAF, now's a good time to double-check both your ruleset status and your app's Next.js version!

Related posts