WAF - WAF Release - 2026-09-08

This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset …c76ba662 N/A Next.js - Image Optimizer Remote Code Execution via Crafted AVIF - Beta Log Block This rule is merged into the original rule “Next.js - Image Optimizer Remote Code Execution via Crafted AVIF” (ID: …80256efe ). Cloudflare Managed Ruleset …208457cf N/A Next.js - Remote Code Execution - CVE:CVE-2