WAF Release - New vulnerability rules for Next.js, WordPress, and Adobe ColdFusion

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.

WAF rule Next.js - DoS - CVE-2026-64641 ( ...90dcdb0a ) has been deployed to provide coverage.

Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.

This is a middleware bypass that unfortunately cannot be covered through Cloudflare WAF signature engine.

A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.

Existing SSRF rules provide adequate coverage for this vulnerability, no tailored WAF rule was developed.

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.

WAF rule Next.js - SSRF - CVE-2026-64649 ( ...930091a3 ) has been deployed to provide coverage.

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.

Malicious request is unfortunately indistinguishable from a legitimate image optimization request, so no WAF rule has been created to address this vulnerability.

A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.

Unfortunately there is no one size fits all rule that can be deployed through WAF in lieu of custom bodySizeLimit configurations, so no WAF rule has been created to address this vulnerability.

In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.

WAF rule Next.js - Information Disclosure - CVE-2026-64643 ( ...72952826 ) has been deployed to provide coverage.

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the shape fetch(new Request(init), aDifferentInit)

This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters.

This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This was labeled as Generic Rules - SQLi.

This was labeled as Generic Rules - Unauthenticated RCE.

This was labeled as Generic Rules - SQLi.

This was labeled as Generic Rules - Unauthenticated RCE.

This is a new detection.

This is a new detection.

This is a new detection.

This is a new detection.

This detection has been removed.

This detection has been removed.

This detection has been removed.