WAF Release - 2026-08-25

This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.

Key Findings

• Four new detections move from Log to Block: HTTP/2 Request Smuggling - Request Body Anomaly and XSS - JavaScript Event Handler Coercion across Headers, Body, and URI.
• The XSS, HTML Injection - Script Tag - Beta rule is merged into the original rule.
• A Generic Rules - Remote Code Execution detection is added in Block mode.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · a80f214f0947435dabb2ba2d1489d892 · N/A · HTTP/2 Request Smuggling - Request Body Anomaly · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · 58a184412d2b4113bca6379b20646260 · N/A · XSS - JavaScript Event Handler Coercion - Headers · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · e79cb939d6aa41db984e6db3d706d517 · N/A · XSS - JavaScript Event Handler Coercion - Body · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · 7e3249c7a5d8469697478746660886c8 · N/A · XSS - JavaScript Event Handler Coercion - URI · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · d34bc5db8cbc4e18a44ed115c293b926 · N/A · XSS, HTML Injection - Script Tag - Beta · Log · Block · This rule is merged into the original rule "XSS, HTML Injection - Script Tag" (ID: 9c8dda9708cc4452ac76e7be7b58420b).

Cloudflare Managed Ruleset · 2b6b94ec864d47f99630ecf72ca6cce3 · N/A · Generic Rules - Remote Code Execution · N/A · Block · This is a new detection.