WAF Emergency Release: Next.js RCE Protections (CVE-2026-75604, GHSA-2xp9-vwfh-vxw4)
Emergency update to WAF ruleset with enhanced detection for Next.js remote code execution via CVE-2026-75604 on Windows hosts and a new rule for RCE via crafted AVIF images in the Next.js Image Optimizer. Both vulnerabilities affect unauthenticated users.
This emergency release updates an existing Next.js remote code execution rule to identify CVE-2026-75604 and adds a new rule for remote code execution in the Next.js Image Optimizer via crafted AVIF images.
Key Findings
-
CVE-2026-75604 affects Windows-hosted Next.js applications using both the Pages Router and App Router without Cache Components and can lead to unauthenticated remote code execution.
-
GHSA-2xp9-vwfh-vxw4 affects the Next.js Image Optimizer and can lead to unauthenticated remote code execution when it optimizes an attacker-controlled AVIF image.
Impact
Next.js recommends updating to version 16.3.3 or 15.5.24 to address these vulnerabilities.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...2ca6cce3 | N/A | Next.js - Remote Code Execution - CVE:CVE-2026-75604 | Block | N/A | Rule metadata description refined. Detection unchanged. |
| Cloudflare Managed Ruleset | ...80256efe | N/A | Next.js - Image Optimizer Remote Code Execution via Crafted AVIF | N/A | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
DNS - Configure Advanced Custom Nameservers with nameserver sets
Nameserver sets are now available in beta for Enterprise accounts, allowing you to group custom nameserver names with Cloudflare-assigned IP addresses and assign them to multiple zones. This new approach replaces legacy custom_ns sets with reusable, immutable objects that support up to 3 IPv4 and 3 IPv6 addresses per nameserver and can leverage Advanced anycast network groups for improved resiliency.
Emergency WAF managed rule for active RCE vulnerability
Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.
Cloudflare API MCP server sends Workers Issues as MCP Events
The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.