WAF - WAF Release - 2026-07-29

<p>This release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.</p> <p><strong>Key Findings</strong></p> <ul> <li> <p>Nuxt Server Island - RCE(GHSA-9473-5f9j-94wq): An unauthenticated vulnerability in Nuxt Server Islands where remote attackers can supply arbitrary component names or props to endpoints. Manipulating these parameters allows unauthenticated component Remote Code Execution (RCE) on the server.</p> </li> <li> <p>Alibaba Fastjson JSONType Remote Code Execution: A unauthenticated remote code execution vulnerability in Alibaba Fastjson (≤ 1.2.83) during JSON deserialization. Under default configurations, attackers can execute arbitrary system commands, bypassing traditional classpath and gadget-based defenses.</p> </li> <li> <p>Generic Protections (SSRF &amp; Command Injection): Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications, alongside new rules targeting obfuscated command injection patterns across request parameters.</p> </li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="54e1733b10da4a599e06c6fbc2e84e2d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 54e1733b10da4a599e06c6fbc2e84e2d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...c2e84e2d</span></button></span></td><td>N/A</td><td>SSRF - Cloud - Beta</td><td>Log</td><td>Block</td><td><p>This is an improved detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="95a84ab1645a49c685648c17761e7a4c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 95a84ab1645a49c685648c17761e7a4c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...761e7a4c</span></button></span></td><td>N/A</td><td>Command Injection - Obfuscation</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="58df9693db4d454a8764fcda7347c892"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 58df9693db4d454a8764fcda7347c892" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7347c892</span></button></span></td><td>N/A</td><td>Alibaba Fastjson JSONType Remote Code Execution - Body</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="6159ead63d284147943dc5a18ec012ea"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6159ead63d284147943dc5a18ec012ea" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...8ec012ea</span></button></span></td><td>N/A</td><td>Nuxt Server Island - RCE</td><td>N/A</td><td>Block</td><td><p>This is a new detection.This was labeled as Generic Rules - RCE.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="dcf635ab2e744e1a994443973590a4ad"><button type="button" title="Copy rule ID" aria-label="Copy rule ID dcf635ab2e744e1a994443973590a4ad" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...3590a4ad</span></button></span></td><td>N/A</td><td>Generic Rules - RCE</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="d3852d0891634686a46114069c6dff1c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID d3852d0891634686a46114069c6dff1c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9c6dff1c</span></button></span></td><td>N/A</td><td>Generic Rules - XSS</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="89d0243997d24c6ea1d610a23a5b40d6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 89d0243997d24c6ea1d610a23a5b40d6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...3a5b40d6</span></button></span></td><td>N/A</td><td>File Upload - RCE</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="6ad9f2049b094c608be0f8adcfe1a93c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6ad9f2049b094c608be0f8adcfe1a93c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...cfe1a93c</span></button></span></td><td>N/A</td><td>Generic Rules - RCE</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="5bdf578fff504b8cbe3b7f699ab5ed95"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 5bdf578fff504b8cbe3b7f699ab5ed95" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9ab5ed95</span></button></span></td><td>N/A</td><td>Generic Rules - XSS</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="7ecac499d14a4750aa58c1e21b7f9c67"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7ecac499d14a4750aa58c1e21b7f9c67" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...1b7f9c67</span></button></span></td><td>N/A</td><td>File Upload - RCE</td><td>N/A</td><td>Block</td><td><p>This is a new detection.</p></td></tr></tbody></table>