WAF - WAF Release - 2026-07-21

<p>This release introduces new rules for vulnerabilities in Adobe ColdFusion, Next.js, WordPress alongside updates to existing rules thereby providing enhanced generic protections against Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS).</p> <p><strong>WAF and framework adapter mitigations for Next.js vulnerabilities</strong></p> <p>Multiple <a href="https://nextjs.org/blog/july-2026-security-release" target="_blank" rel="noopener">security vulnerabilities<span class="external-link"> ↗︎</span></a> were disclosed and patched by the Next.js team through July 2026 security release. These include denial of service, middleware and proxy bypass, server-side request forgery, information disclosure, and cache poisoning across a range of severities.</p> <p>Several of the disclosed vulnerabilities are not possible to block at WAF layer,we strongly recommend updating your application and its dependencies immediately. Patched versions are available through v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues.</p> <table style="width: 100%"><thead><tr><th>Advisory</th><th>CVE</th><th>Severity</th><th>Issue</th><th>WAF Coverage</th></tr></thead><tbody><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></td><td>CVE-2026-64641</td><td>High</td><td><p>Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.</p></td><td><p>WAF rule Next.js - DoS - CVE-2026-64641 (<span class="rule-id" data-rule-id="b013b67c357547b4b866234390dcdb0a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID b013b67c357547b4b866234390dcdb0a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...90dcdb0a</span></button></span>) has been deployed to provide coverage.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></td><td>CVE-2026-64642</td><td>High</td><td><p>Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.</p></td><td><p>This is a middleware bypass that unfortunately cannot be covered through Cloudflare WAF signature engine.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></td><td>CVE-2026-64645</td><td>High</td><td><p>A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.</p></td><td><p>Existing SSRF rules provide adequate coverage for this vulnerability, no tailored WAF rule was developed.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></td><td>CVE-2026-64649</td><td>High</td><td><p>When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.</p></td><td><p>WAF rule Next.js - SSRF - CVE-2026-64649 (<span class="rule-id" data-rule-id="7fe6d6f3df774ae2a0011f20930091a3"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7fe6d6f3df774ae2a0011f20930091a3" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...930091a3</span></button></span>) has been deployed to provide coverage.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></td><td>CVE-2026-64644</td><td>Medium</td><td><p>When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.</p></td><td><p>Malicious request is unfortunately indistinguishable from a legitimate image optimization request, so no WAF rule has been created to address this vulnerability.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></td><td>CVE-2026-64646</td><td>Medium</td><td><p>A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.</p></td><td><p>Unfortunately there is no one size fits all rule that can be deployed through WAF in lieu of custom bodySizeLimit configurations, so no WAF rule has been created to address this vulnerability.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></td><td>CVE-2026-64643</td><td>Medium</td><td><p>In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.</p></td><td><p>WAF rule Next.js - Information Disclosure - CVE-2026-64643 (<span class="rule-id" data-rule-id="6c4135d4d9d745e4866ad83672952826"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6c4135d4d9d745e4866ad83672952826" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...72952826</span></button></span>) has been deployed to provide coverage.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></td><td>CVE-2026-64648</td><td>Medium</td><td><p>A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the shape fetch(new Request(init), aDifferentInit)</p></td><td><p>This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.</p></td></tr><tr><td><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></td><td>CVE-2026-64647</td><td>Medium</td><td><p>A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters.</p></td><td><p>This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.</p></td></tr></tbody></table> <p><strong>Key Findings</strong></p> <ul> <li> <p>CVE-2026-48276: A path traversal vulnerability in Adobe ColdFusion file upload mechanisms allows unauthenticated attackers to write or upload files to arbitrary locations outside designated directories on the origin server.</p> </li> <li> <p>CVE-2026-48282: A path traversal vulnerability in Adobe ColdFusion enables unauthenticated attackers to manipulate directory sequences and access restricted system files on the host filesystem.</p> </li> <li> <p>CVE-2026-60137: An unauthenticated SQL injection vulnerability affecting WordPress. Threat actors exploit unsanitized input parameters to execute arbitrary SQL queries, leading to unauthorized database access, record manipulation, or data exfiltration.</p> </li> <li> <p>CVE-2026-63030: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.</p> </li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="7fbdc9407bdb4a4eae2b3d91215e7d31"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7fbdc9407bdb4a4eae2b3d91215e7d31" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...215e7d31</span></button></span></td><td>N/A</td><td>SSRF - Restricted Protocol</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="6ca512d240d848d6a0c7ef42a935ee5d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6ca512d240d848d6a0c7ef42a935ee5d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...a935ee5d</span></button></span></td><td>N/A</td><td>SSRF - Obfuscated Host</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="a3fb0870c38440d8a9a0eba81b0230ac"><button type="button" title="Copy rule ID" aria-label="Copy rule ID a3fb0870c38440d8a9a0eba81b0230ac" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...1b0230ac</span></button></span></td><td>N/A</td><td>LFI - Path Traversal</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="452a04be3f73458c863d8dae61349c8b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 452a04be3f73458c863d8dae61349c8b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...61349c8b</span></button></span></td><td>N/A</td><td>Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="a53a3fb491c64d74908081ee9cb61eac"><button type="button" title="Copy rule ID" aria-label="Copy rule ID a53a3fb491c64d74908081ee9cb61eac" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9cb61eac</span></button></span></td><td>N/A</td><td>Adobe ColdFusion - Path Traversal - CVE:CVE-2026-48282</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="d8b63828c2344d919b94d2594ac5e21f"><button type="button" title="Copy rule ID" aria-label="Copy rule ID d8b63828c2344d919b94d2594ac5e21f" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...4ac5e21f</span></button></span></td><td>N/A</td><td>XSS — JS Bracket Concat Obfuscation - Body</td><td>Log</td><td>Disabled</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="264a83a764be428ca41d516ff31f5559"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 264a83a764be428ca41d516ff31f5559" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...f31f5559</span></button></span></td><td>N/A</td><td>XSS — JS Bracket Concat Obfuscation - Headers</td><td>Log</td><td>Disabled</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="4ba21a60837244029183b782987984fd"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 4ba21a60837244029183b782987984fd" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...987984fd</span></button></span></td><td>N/A</td><td>XSS — JS Bracket Concat Obfuscation - URI</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="1c060d3a371549219ee290d7ed933fcc"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 1c060d3a371549219ee290d7ed933fcc" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ed933fcc</span></button></span></td><td>N/A</td><td>Wordpress - SQL Injection - CVE:CVE-2026-60137</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - SQLi.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="7dfb2bd4708d4b88b9911dc0550664b6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7dfb2bd4708d4b88b9911dc0550664b6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...550664b6</span></button></span></td><td>N/A</td><td>Wordpress - Remote Code Execution - CVE:CVE-2026-63030</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - Unauthenticated RCE.</p></td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="db003b39b7774859a8d588ce33697a1a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID db003b39b7774859a8d588ce33697a1a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...33697a1a</span></button></span></td><td>N/A</td><td>Wordpress - SQL Injection - CVE:CVE-2026-60137</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - SQLi.</p></td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="ebd3f2df15c74ddcbf6220c9b5ec246a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID ebd3f2df15c74ddcbf6220c9b5ec246a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...b5ec246a</span></button></span></td><td>N/A</td><td>Wordpress - Remote Code Execution - CVE:CVE-2026-63030</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - Unauthenticated RCE.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="6c4135d4d9d745e4866ad83672952826"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6c4135d4d9d745e4866ad83672952826" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...72952826</span></button></span></td><td>N/A</td><td>Next.js - Information Disclosure - CVE-2026-64643</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - Information Disclosure.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="7fe6d6f3df774ae2a0011f20930091a3"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7fe6d6f3df774ae2a0011f20930091a3" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...930091a3</span></button></span></td><td>N/A</td><td>Next.js - SSRF - CVE-2026-64649</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - Auth Bypass - 2.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="c4ca56c0a6a348299d5a93e663167195"><button type="button" title="Copy rule ID" aria-label="Copy rule ID c4ca56c0a6a348299d5a93e663167195" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...63167195</span></button></span></td><td>N/A</td><td>Next.js - Remote Code Execution - Cache Components</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - RCE.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="b013b67c357547b4b866234390dcdb0a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID b013b67c357547b4b866234390dcdb0a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...90dcdb0a</span></button></span></td><td>N/A</td><td>Next.js - DoS - CVE-2026-64641</td><td>N/A</td><td>Block</td><td><p>This was labeled as Generic Rules - DoS.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="aa21c9b8b97743bfb217748b2049a60c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID aa21c9b8b97743bfb217748b2049a60c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...2049a60c</span></button></span></td><td>N/A</td><td>Generic Rules - Command Execution - Body - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="e7ee67e824844754b513cdf3836855a4"><button type="button" title="Copy rule ID" aria-label="Copy rule ID e7ee67e824844754b513cdf3836855a4" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...836855a4</span></button></span></td><td>N/A</td><td>Generic Rules - Command Execution - Header - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="5f2a6681a2b94442b23816286d060a0d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 5f2a6681a2b94442b23816286d060a0d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...6d060a0d</span></button></span></td><td>N/A</td><td>Generic Rules - Command Execution - URI - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr></tbody></table>