WAF Release - 2026-09-08

This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · d5d9f863e50b416faf43934dc76ba662 · N/A · Next.js - Image Optimizer Remote Code Execution via Crafted AVIF - Beta · Log · Block · This rule is merged into the original rule "Next.js - Image Optimizer Remote Code Execution via Crafted AVIF" (ID: 18b22b0bd423423c945b3a0180256efe).

Cloudflare Managed Ruleset · 771ac3761dcd485cb0e91ea0208457cf · N/A · Next.js - Remote Code Execution - CVE:CVE-2026-75604 - Beta · Log · Block · This rule is merged into the original rule "Next.js - Remote Code Execution - CVE:CVE-2026-75604" (ID: 2b6b94ec864d47f99630ecf72ca6cce3).