Cloudflare’s Web Application Firewall (WAF) has merged two beta detection rules for Next.js remote‑code‑execution (RCE) issues into the standard Managed Ruleset and upgraded their default action from logging to blocking. This shift moves the protection from passive observation to active denial, directly affecting traffic that attempts the known exploit patterns.
What Changed
The Managed Ruleset now contains two consolidated signatures:
d5d9f863e50b416faf43934dc76ba662– previously a beta rule for the Image Optimizer AVIF RCE, now part of the baseline rule18b22b0bd423423c945b3a0180256efeand set to block.771ac3761dcd485cb0e91ea0208457cf– previously a beta rule for CVE‑2026‑75604, now merged into baseline rule2b6b94ec864d47f99630ecf72ca6cce3and set to block.
Both rules previously logged matching requests; they now automatically block them.
Why It Matters for Engineers
AI and cloud engineers deploying Next.js applications often rely on the image optimizer and other server‑side features that were recently exposed to RCE vectors. With the WAF now enforcing blocks, attempts that would have slipped through as logged events will be stopped at the edge, reducing the attack surface without requiring code changes. Platform and DevOps teams gain a tighter security posture by default, which can simplify compliance and reduce the need for custom rule tuning.
Operational and Security Implications
Switching from log‑only to block has several practical effects:
- Existing monitoring pipelines that consumed WAF logs for these patterns must be updated to handle blocked events instead of logs.
- Any custom rule sets referencing the original beta rule IDs need to be reviewed, as the IDs are now subsumed under the baseline signatures.
- Blocking may introduce false positives for legitimate traffic that matches the signature patterns; teams should monitor the new block counts and adjust upstream request handling if needed.
- Security engineers can rely on the WAF to enforce protection for the two documented Next.js RCE vectors without additional configuration, but they should still validate that their application stack is patched against the underlying vulnerabilities.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Review your Cloudflare WAF dashboard to confirm the merged rules are active and set to block. Update any alerting or log‑processing that expected only log entries for these signatures. Conduct a brief traffic test to ensure legitimate Next.js image optimizer requests are not unintentionally blocked, and adjust rule exceptions only if a genuine false positive is identified. Ongoing vigilance on block metrics will confirm the change delivers the intended security benefit without disrupting normal operations.
