Live
Self‑Managing Context in LLMs Reduces Compute Overhead and Improves ThroughputAI‑Generated OSS Vulnerability Scans Overwhelm Human Review – Implications for Security OpsBootstrapping Claude Code with Dependency Records Eliminates Initial Memory RequirementsEnterprise Copilot model control and MCP startup options in JetBrains pluginMicrosoft‑Decision‑1 Arrives on Foundry: What Engineers Need to KnowIntegrating Production Feedback into the AI Agent Lifecycle: Practical Architecture and Ops GuidanceOpenTelemetry tracing expands across Cloudflare’s proxy stack in betaDynamic Model Triage: Engineering Implications of Grok Bot’s Multi‑Model BackendSelf‑Managing Context in LLMs Reduces Compute Overhead and Improves ThroughputAI‑Generated OSS Vulnerability Scans Overwhelm Human Review – Implications for Security OpsBootstrapping Claude Code with Dependency Records Eliminates Initial Memory RequirementsEnterprise Copilot model control and MCP startup options in JetBrains pluginMicrosoft‑Decision‑1 Arrives on Foundry: What Engineers Need to KnowIntegrating Production Feedback into the AI Agent Lifecycle: Practical Architecture and Ops GuidanceOpenTelemetry tracing expands across Cloudflare’s proxy stack in betaDynamic Model Triage: Engineering Implications of Grok Bot’s Multi‑Model Backend
Cloudflare

Cloudflare WAF adds block for Next.js Image Optimizer AVIF RCE and refines CVE‑2026‑75604 rule

Ninja·August 26, 2026·2 min read·via Cloudflare Application Security
AI SummaryPowered by AI

Cloudflare added a block rule for Next.js Image Optimizer AVIF attacks and refined the description of the existing CVE‑2026‑75604 rule. Practitioners need to ensure the rules are active and upgrade Next.js to the recommended versions to prevent unauthenticated remote code execution.

Cloudflare’s emergency WAF release adds a new rule that blocks remote code execution attempts against the Next.js Image Optimizer when it processes crafted AVIF images, and it refines the description of the existing rule that already blocks the CVE-2026-75604 vulnerability. Both changes matter because they address unauthenticated code‑execution paths that can affect Windows‑hosted Next.js deployments and any service that accepts user‑supplied images.

What Changed in the Managed Ruleset

  • The rule for Next.js - Remote Code Execution - CVE:CVE-2026-75604 retains its block action but now includes a refined metadata description; detection logic is unchanged.
  • A brand‑new rule, identified by its Cloudflare rule ID, targets Next.js - Image Optimizer Remote Code Execution via Crafted AVIF and enforces a block action for the first time.

Why It Impacts Practitioners

AI engineers and platform teams that embed Next.js front‑ends often rely on the framework’s built‑in image pipeline for performance. If an attacker can upload a malicious AVIF file, the optimizer could execute arbitrary code, compromising the host environment. The CVE-2026-75604 issue specifically affects Windows‑hosted Next.js apps that use the Pages Router or App Router without Cache Components, exposing a remote execution vector that does not require authentication. For DevOps and SRE staff, these vulnerabilities translate into potential service outages, data loss, or lateral movement within a cloud tenant. Security engineers must treat the findings as high‑severity because they bypass typical authentication checks.

Operational and Security Implications

  • Ensure the Cloudflare Managed Ruleset is enabled on any domain that fronts a Next.js application, and verify that the new AVIF rule is active.
  • Audit deployment pipelines for the Next.js version in use; the vendor recommends upgrading to 16.3.3 or 15.5.24 to mitigate the underlying code flaws.
  • Update CI/CD validation steps to flag usage of outdated Next.js versions on Windows hosts, especially when Cache Components are omitted.
  • Monitor WAF logs for blocked attempts matching the new rule ID; a sudden increase may indicate active probing.
  • Consider testing the image processing path with controlled AVIF payloads in a staging environment to confirm the block is effective.

Related CloudNinjas coverage: security.

What This Means For Practitioners

Review your Next.js stack immediately: confirm the runtime version meets the recommended releases, and verify that Cloudflare’s WAF is applying both the refined CVE rule and the new AVIF rule. Incorporate version checks into automated linting or dependency‑update bots, and add alerting for WAF block events related to these rule IDs. By doing so, you close the most direct unauthenticated RCE vectors that the emergency release addresses.

Tags: #next.js#waf#remote-code-execution#cloudflare
Originally published atCloudflare Application Security
Related Articles
GitHub

CodeQL 2.27.2 expands language models and tightens macOS build support – what engineers need to know

4 min read
Redhat

Java vulnerability surge pushes DevSecOps toward continuous automated patching

3 min read
Cloudflare

Leverage Cloudflare's Failed Detections Field in WAF and Rate‑Limiting Rules

3 min read