What happened?
Vendor claim: Cloudflare announced an emergency WAF release on 2026‑08‑26 that updates its Managed Ruleset to address critical Next.js remote code execution (RCE) vulnerabilities.
Key findings
- CVE‑2026‑75604 – Affects Windows‑hosted Next.js applications using the Pages Router or App Router without Cache Components. It enables unauthenticated RCE.
- GHSA‑2xp9‑vwfh‑vxw4 – A flaw in the Next.js Image Optimizer that can execute code when processing a malicious AVIF image.
Impact and mitigation
Next.js advises upgrading to 16.3.3 or 15.5.24 to remediate the vulnerabilities. Until patches are applied, Cloudflare’s WAF rules provide an additional layer of protection.
Cloudflare rule changes
| Rule ID | Description | Previous Action | New Action |
|---|---|---|---|
| 2ca6cce3 | Next.js – Remote Code Execution – CVE:CVE-2026-75604 | Block | Block (metadata refined, detection unchanged) |
| 80256efe | Next.js – Image Optimizer Remote Code Execution via Crafted AVIF | N/A | Block (new detection) |
Why it matters
These vulnerabilities allow attackers to run arbitrary code on vulnerable servers without authentication, posing a severe risk to web applications that rely on Next.js. The emergency WAF update demonstrates Cloudflare’s rapid response capability, but developers should still apply the upstream Next.js patches.
Takeaway
Enable the updated Cloudflare Managed Ruleset immediately and verify that the two new rule IDs are active. Simultaneously, update Next.js to the recommended versions to close the underlying code flaws.