WAF: Enhanced Next.js RCE Detection with Consolidated Rules
Cloudflare WAF enhanced its detection logic for Next.js remote code execution vulnerabilities by consolidating active beta rules into baseline signatures. Two beta rules targeting Next.js Image Optimizer RCE and CVE-2026-75604 are now merged into their respective primary rules with logging behavior upgraded to blocking.
This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...c76ba662 | N/A | Next.js - Image Optimizer Remote Code Execution via Crafted AVIF - Beta | Log | Block | This rule is merged into the original rule "Next.js - Image Optimizer Remote Code Execution via Crafted AVIF" (ID: ...80256efe). |
| Cloudflare Managed Ruleset | ...208457cf | N/A | Next.js - Remote Code Execution - CVE:CVE-2026-75604 - Beta | Log | Block | This rule is merged into the original rule "Next.js - Remote Code Execution - CVE:CVE-2026-75604" (ID: ...2ca6cce3). |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare One Client for Windows hotfix - trusted certificate chains
A new GA release for Windows Cloudflare One Client is available, addressing an issue with building trusted certificate chains.
Cloudflare One Client for macOS - Trusted Certificate Chain Fix
A new GA release of the macOS Cloudflare One Client is available. This hotfix addresses an issue with building trusted certificate chains.
Cloudflare One Client for Linux
A new GA release of Cloudflare One Client for Linux is now available. This hotfix addresses an issue with building trusted certificate chains.