WAF - WAF Release - 2026-08-25

<p>This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.</p> <p><strong>Key Findings</strong></p> <ul> <li> <p>Four new detections move from Log to Block: HTTP/2 Request Smuggling - Request Body Anomaly and XSS - JavaScript Event Handler Coercion across Headers, Body, and URI.</p> </li> <li> <p>The XSS, HTML Injection - Script Tag - Beta rule is merged into the original rule.</p> </li> <li> <p>A Generic Rules - Remote Code Execution detection is added in Block mode.</p> </li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="a80f214f0947435dabb2ba2d1489d892"><button type="button" title="Copy rule ID" aria-label="Copy rule ID a80f214f0947435dabb2ba2d1489d892" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...1489d892</span></button></span></td><td>N/A</td><td>HTTP/2 Request Smuggling - Request Body Anomaly</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="58a184412d2b4113bca6379b20646260"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 58a184412d2b4113bca6379b20646260" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...20646260</span></button></span></td><td>N/A</td><td>XSS - JavaScript Event Handler Coercion - Headers</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="e79cb939d6aa41db984e6db3d706d517"><button type="button" title="Copy rule ID" aria-label="Copy rule ID e79cb939d6aa41db984e6db3d706d517" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...d706d517</span></button></span></td><td>N/A</td><td>XSS - JavaScript Event Handler Coercion - Body</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="7e3249c7a5d8469697478746660886c8"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 7e3249c7a5d8469697478746660886c8" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...660886c8</span></button></span></td><td>N/A</td><td>XSS - JavaScript Event Handler Coercion - URI</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="d34bc5db8cbc4e18a44ed115c293b926"><button type="button" title="Copy rule ID" aria-label="Copy rule ID d34bc5db8cbc4e18a44ed115c293b926" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...c293b926</span></button></span></td><td>N/A</td><td>XSS, HTML Injection - Script Tag - Beta</td><td>Log</td><td>Block</td><td>This rule is merged into the original rule &quot;XSS, HTML Injection - Script Tag&quot; (ID: <span class="rule-id" data-rule-id="9c8dda9708cc4452ac76e7be7b58420b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 9c8dda9708cc4452ac76e7be7b58420b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7b58420b</span></button></span>).</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="2b6b94ec864d47f99630ecf72ca6cce3"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 2b6b94ec864d47f99630ecf72ca6cce3" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...2ca6cce3</span></button></span></td><td>N/A</td><td>Generic Rules - Remote Code Execution</td><td>N/A</td><td>Block</td><td>This is a new detection.</td></tr></tbody></table>