Cloudflare Issues Emergency WAF Update to Block Critical Next.js Remote Code Execution Flaws
On August 26 2026 Cloudflare released an emergency Web Application Firewall update that adds blocks for two newly disclosed Next.js remote code execution vulnerabilities (CVE‑2026‑75604 and GHSA‑2xp9‑vwfh‑vxw4). The update refines rule metadata and introduces a new detection for crafted AVIF images.