JA EN
shiichan

Cloudflare's WAF Now Auto-Blocks Next.js RCE Vulnerabilities!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#web

Hi, it's me, Shiichan! Today's update is about Cloudflare's WAF — worth a look if you run a Next.js site behind it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted a WAF release dated September 8, 2026. It strengthens the detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating rules that had been running in beta into the baseline signatures. Two rules in the Cloudflare Managed Ruleset are affected:

  • A rule detecting RCE in the Next.js Image Optimizer via a crafted AVIF image
  • A rule detecting the Next.js RCE tracked as CVE-2026-75604

The story so far

Each of these had a separate beta counterpart (rules with a "- Beta" suffix), and both were set to the "Log" action — meaning they'd flag a suspicious request and record it, but let it through. That's a normal way to watch for false positives while a rule is in beta.

What changes

With this release, the beta rules were merged into their original counterparts, and the action changed from "Log" to "Block." Requests that previously would only have been logged as suspicious will now actually be blocked. If you have the Cloudflare Managed Ruleset enabled, this stronger protection applies automatically — no configuration change needed.

Wrap-up

  • The beta rules for Next.js AVIF-based RCE and CVE-2026-75604 RCE have been merged into their baseline rules
  • The action was upgraded from "Log" (record only) to "Block"
  • This change applies automatically if you're using the Cloudflare Managed Ruleset
  • If you run a Next.js app behind Cloudflare, it's worth checking your WAF event logs to confirm the new behavior

Related posts