{"id":"CVE-2025-55184","kind":"vulnerability","aliases":["CVE-2025-55184"],"related":[],"title":"React Server Components: unauthenticated requests can crash the server","description":"WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF and framework adapter mitigations for React and Next.js vulnerabilities\n\nMultiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.\n\nWe strongly recommend updating your application and its dependencies immediately. Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`).\n\n#### WAF protections\n\nCloudflare WAF rules deployed in response to prior React Server Component CVEs (`CVE-2025-55184` ↗︎ and `CVE-2026-23864` ↗︎) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset.\n\n| Ruleset | Rule description | Rule ID | Default action |\n| --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2025-55184` ↗︎ | `2694f1610c0b471393b21aef102ec699` | Disabled |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2026-23864` ↗︎ | `aaede80b4d414dc89c443cea61680354` | Block |\n\nThe existing rules detect the underlying attack patterns generically. As a result, they apply to the new `CVE-2026-23870` ↗︎ denial-of-service vulnerability in Server Components and the corresponding Next.js advisory `GHSA-8h8q-6873-q5fj` ↗︎.\n\nCloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎, `GHSA-267c-6grr-h53f` ↗︎, and `GHSA-mg66-mrh9-m8jx` ↗︎. If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the WAF changelog. Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible.\n\nSeveral of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations.\n\nCustomers on Pro, Business, or Enterprise plans should ensure that Managed Rules are enabled.\n\n#### Next.js adapters\n\nVinext: Vinext ↗︎ is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` (PR #1118 ↗︎, PR #1112 ↗︎) to prevent accidentally running a vulnerable version of React with Vinext.\n\nOpenNext on Cloudflare: OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions (PR #1255 ↗︎).\n\n#### Summary of disclosed vulnerabilities\n\n| Advisory | Severity | Issue | WAF status |\n| --- | --- | --- | --- |\n| `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎ | High | Denial of service in Server Components | WAF rules in place: `2694f1610c0b471393b21aef102ec699`, `aaede80b4d414dc89c443cea61680354` Cloudflare is investigating additional managed WAF coverage |\n| `GHSA-267c-6grr-h53f` ↗︎ | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-mg66-mrh9-m8jx` ↗︎ | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-492v-c6pp-mqqv` ↗︎ | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-c4j6-fc7j-m34r` ↗︎ | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-36qx-fr4f-26g5` ↗︎ | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-ffhc-5mcf-pf4q` ↗︎ | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-gx5p-jg67-6x7h` ↗︎ | Moderate | XSS in `beforeInteractive` scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-h64f-5h5j-jqjh` ↗︎ | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-wfc6-r584-vfw7` ↗︎ | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-vfv6-92ff-j949` ↗︎ | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-3g8h-86w9-wvmq` ↗︎ | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior |","summary":"React Server Components in React 19.0.0 through 19.2.1 can be crashed by a crafted request that needs no login. An attacker can take a server offline with a denial of service, and Next.js apps that bundle the affected code are exposed too.","severity":"high","cvss":7.5,"epss":0.66882,"exploited":false,"exploited_at":null,"products":[{"name":"facebook react","fixed":["19.0.2"],"affected":">= 19.0.0, < 19.0.2","ecosystem":"vendor"},{"name":"facebook react","fixed":["19.1.3"],"affected":">= 19.1.0, < 19.1.3","ecosystem":"vendor"},{"name":"facebook react","fixed":["19.2.2"],"affected":">= 19.2.0, < 19.2.2","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["14.2.35"],"affected":">= 13.3.0, < 14.2.35","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.0.7"],"affected":">= 15.0.0, < 15.0.7","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.1.11"],"affected":">= 15.1.0, < 15.1.11","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.2.8"],"affected":">= 15.2.0, < 15.2.8","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.3.8"],"affected":">= 15.3.0, < 15.3.8","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.4.10"],"affected":">= 15.4.0, < 15.4.10","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["15.5.9"],"affected":">= 15.5.0, < 15.5.9","ecosystem":"vendor"},{"name":"vercel next.js","fixed":["16.0.10"],"affected":">= 16.0.0, < 16.0.10","ecosystem":"vendor"},{"name":"vercel next.js","fixed":[],"affected":"= 15.6.0","ecosystem":"vendor"},{"name":"vercel next.js","fixed":[],"affected":"= 16.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","next.js","package","react","self-hosted","server-components"],"not_affected_if":["not-using-server-components"],"how_to_check":"- Run `npm ls react react-dom` in the project and compare the React version against the fixed versions below.\n- Run `npm ls next` and compare the Next.js version against the fixed versions below.\n- Check whether the app uses React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, or the Next.js App Router).\n- Confirm the lockfile (`package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`) pins the patched version, not just `package.json`.","fix":"- React: move to `19.0.2`, `19.1.3`, or `19.2.2` on the matching line; the newer sources list `19.0.6`, `19.1.7`, and `19.2.6` as the latest patched releases.\n- Next.js: move to `14.2.35`, `15.0.7`, `15.1.11`, `15.2.8`, `15.3.8`, `15.4.10`, `15.5.9`, or `16.0.10`; the newer sources list `15.5.16` and `16.2.5` as the latest patched releases.\n- Redeploy after updating, since the running process keeps the old code until restarted.\n- A Cloudflare WAF managed rule may block some attack patterns, but the sources say updating is the fix and WAF coverage is not complete.","status":"open","published_at":"2025-12-11T20:16:00+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:30:07+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:30:07Z","model":"claude-haiku-5-5","output":{"fix":"- React: move to `19.0.2`, `19.1.3`, or `19.2.2` on the matching line; the newer sources list `19.0.6`, `19.1.7`, and `19.2.6` as the latest patched releases.\n- Next.js: move to `14.2.35`, `15.0.7`, `15.1.11`, `15.2.8`, `15.3.8`, `15.4.10`, `15.5.9`, or `16.0.10`; the newer sources list `15.5.16` and `16.2.5` as the latest patched releases.\n- Redeploy after updating, since the running process keeps the old code until restarted.\n- A Cloudflare WAF managed rule may block some attack patterns, but the sources say updating is the fix and WAF coverage is not complete.","reach":"internet","title":"React Server Components: unauthenticated requests can crash the server","impact":"medium","summary":"React Server Components in React 19.0.0 through 19.2.1 can be crashed by a crafted request that needs no login. An attacker can take a server offline with a denial of service, and Next.js apps that bundle the affected code are exposed too.","category":"package","nicknames":[],"who_cares":["react","next.js","self-hosted","server-components"],"confidence":0.8,"needs_auth":"no","worst_case":"Server stops responding to users; attacker causes denial of service","analyst_note":"The product list gives no fixed version for Next.js 15.6.0 (fixed is '?'); check the GHSA advisory for the 15.6 line before marking it safe.","how_to_check":"- Run `npm ls react react-dom` in the project and compare the React version against the fixed versions below.\n- Run `npm ls next` and compare the Next.js version against the fixed versions below.\n- Check whether the app uses React Server Components (react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, or the Next.js App Router).\n- Confirm the lockfile (`package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`) pins the patched version, not just `package.json`.","needs_analyst":true,"not_affected_if":["not-using-server-components"],"who_is_affected":"Teams running React Server Components on a server they expose to the internet, including Next.js App Router apps and custom RSC setups using the react-server-dom packages. Apps that do not use React Server Components at all are not affected by this flaw. Teams behind a managed WAF still need to update, since the sources say the WAF rules do not cover every variant.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00198,"input_tokens":6280,"output_tokens":2704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A,228C,286C '-2026':232C,296C,318C,359C,669C '-23864':233C,297C '-23870':319C,360C,670C '-55184':12A,15A,229C,287C '1112':570C '1118':568C '1255':658C '15.5.16':210C '16.2.5':212C '19.0.0':60B '19.0.6':204C '19.1.7':205C '19.2.1':62B '19.2.6':207C,559C '2026':116C '267c':368C '2694f1610c0b471393b21aef102ec699':288C '6873':336C,364C,674C '6grr':369C '7':115C '8h8q':335C,363C,673C 'aaede80b4d414dc89c443cea61680354':298C 'accident':573C 'across':166C 'action':255C,279C 'adapt':99C,120C,476C,588C,630C,645C 'add':400C,556C 'addit':401C 'advanc':423C 'advisori':332C,357C,663C 'affect':92B,138C,514C 'alreadi':234C 'announc':409C 'api':487C 'app':88B,594C 'appli':313C 'applic':177C,396C,451C,623C 'architectur':504C 'attack':75B,306C 'avail':185C 'behavior':397C 'block':254C,299C,443C 'boundari':548C 'break':395C 'bundl':90B 'busi':464C 'bypass':152C 'cach':163C 'changelog':106C,107C,413C 'cloudflar':42B,113C,215C,261C,280C,290C,338C,398C,420C,584C,597C,644C 'code':93B,515C 'compon':3A,54B,57B,141C,225C,327C 'correspond':330C 'coverag':236C 'craft':68B 'crash':7A,65B 'creat':382C 'cross':159C 'cross-sit':158C 'custom':258C,267C,461C 'cve':10A,13A,227C,231C,285C,295C,317C,358C,613C,668C 'cves':226C,390C,501C 'data':533C,545C 'data-rout':532C 'default':251C,278C 'defens':554C 'denial':83B,146C,242C,321C,610C,677C 'denial-of-servic':241C,320C,609C 'depend':180C 'deploy':218C,349C,592C 'descript':275C 'detect':303C 'differ':505C 'direct':604C 'disabl':289C 'disclos':131C,240C,437C,500C,661C 'disclosur':45B 'dom':191C,196C,202C 'dos':284C,294C 'effect':348C 'enabl':249C,474C 'endpoint':535C 'ensur':469C 'enterpris':466C 'exampl':518C,649C 'exist':301C 'expos':95B,529C 'extra':551C 'facebook':16A,18A,20A 'fixtur':647C 'forgeri':157C 'framework':98C,119C 'free':265C,270C 'generic':308C 'ghsa':334C,362C,367C,373C,672C 'ghsa-267c-6grr-h53f':366C 'ghsa-8h8q':333C,361C,671C 'ghsa-mg66-mrh9-m8jx':372C 'h53f':370C 'harden':633C 'header':539C 'high':355C,676C 'high-sever':354C 'host':51B 'id':277C 'immedi':181C 'implement':522C 'improv':111C 'includ':145C,264C 'init':566C 'intern':538C 'investig':340C,428C 'issu':165C,665C 'lab':44B 'lab-disclosur':43B 'later':561C 'latest':491C 'layer':552C 'let':590C 'level':171C 'login':73B 'm8jx':376C 'manag':262C,271C,281C,291C,384C,402C,471C 'may':114C 'mg66':374C 'middlewar':149C 'minim':422C 'mitig':100C,121C,388C,431C,460C 'mrh9':375C 'multipl':127C 'must':616C 'need':71B 'new':108C,316C,640C 'newli':239C 'next.js':23A,25A,27A,29A,31A,33A,35A,37A,39A,41A,46B,87B,104C,125C,143C,209C,331C,475C,486C,508C,593C,619C 'nextj':544C 'notic':424C 'offlin':80B 'opennext':582C,585C,600C,625C 'packag':47B 'page':530C 'parcel':197C 'patch':182C,655C 'path':516C 'pattern':307C 'plan':266C,467C 'platform':599C 'plugin':482C 'poison':164C 'possibl':380C,433C,441C 'potenti':394C 'ppr':524C 'pr':567C,569C,657C 'prevent':572C 'prior':222C 'pro':463C 'protect':214C 'protocol':526C 'provid':235C 'proxi':151C 'pure':456C 'q5fj':337C,365C,675C 'rang':168C 'react':1A,17A,19A,21A,48B,55B,59B,102C,123C,134C,139C,187C,189C,194C,200C,223C,283C,293C,558C,579C,608C 'react-server-dom-parcel':193C 'react-server-dom-turbopack':199C 'react-server-dom-webpack':188C 'recommend':174C,448C 'reimplement':484C 'releas':492C,638C 'reliant':457C 'request':5A,69B,156C,547C 'requir':562C 'respons':220C 'result':311C 'resum':525C 'rout':534C 'router':531C 'rule':217C,247C,274C,276C,302C,343C,386C,404C,406C,472C 'ruleset':263C,272C,273C,282C,292C 'run':564C,574C 'safe':346C 'script':161C 'se':679C 'secur':128C 'self':50B 'self-host':49B 'server':2A,9A,53B,56B,79B,140C,154C,190C,195C,201C,224C,326C 'server-compon':52B 'server-sid':153C 'servic':85B,148C,244C,323C,612C 'sever':170C,356C,434C,664C 'share':418C 'side':155C 'sidestep':512C 'site':160C 'status':667C 'still':427C 'stock':507C 'strip':537C 'strong':173C,447C 'summari':659C 'surfac':488C 'take':77B 'team':135C,626C 'test':646C 'three':351C 'turbopack':203C 'unauthent':4A 'under':305C 'updat':109C,175C,449C,617C,628C,652C 'use':259C,268C,654C 'user':615C 'vector':636C 'vercel':22A,24A,26A,28A,30A,32A,34A,36A,38A,40A,137C 'version':183C,577C,620C,641C,656C 'vinext':477C,478C,489C,502C,565C,581C 'vite':481C 'vulner':105C,126C,129C,245C,324C,416C,438C,495C,576C,605C,662C 'waf':96C,117C,213C,216C,342C,385C,403C,412C,430C,445C,459C,666C 'way':510C 'webpack':192C 'whether':341C 'worker':598C 'x':543C 'x-nextjs-data':542C","nicknames":[],"mitigations":[],"who_affected":"Teams running React Server Components on a server they expose to the internet, including Next.js App Router apps and custom RSC setups using the react-server-dom packages. Apps that do not use React Server Components at all are not affected by this flaw. Teams behind a managed WAF still need to update, since the sources say the WAF rules do not cover every variant.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-11T20:16:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cve-assign@fb.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/#CVE-2025-55184","url":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/","severity":null,"published_at":"2026-05-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog"},{"source":"nvd","external_id":"CVE-2025-55184","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55184","severity":null,"published_at":"2025-12-11T20:16:00+00:00","modified_at":"2026-10-07T20:10:01+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2025-55184","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-55184","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2906,"url":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/","title":"Cloudflare: WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog","kind":"advisory","source":"lab","text":"WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF and framework adapter mitigations for React and Next.js vulnerabilities\n\nMultiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.\n\nWe strongly recommend updating your application and its dependencies immediately. Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`).\n\n#### WAF protections\n\nCloudflare WAF rules deployed in response to prior React Server Component CVEs (`CVE-2025-55184` ↗︎ and `CVE-2026-23864` ↗︎) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset.\n\n| Ruleset | Rule description | Rule ID | Default action |\n| --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2025-55184` ↗︎ | `2694f1610c0b471393b21aef102ec699` | Disabled |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2026-23864` ↗︎ | `aaede80b4d414dc89c443cea61680354` | Block |\n\nThe existing rules detect the underlying attack patterns generically. As a result, they apply to the new `CVE-2026-23870` ↗︎ denial-of-service vulnerability in Server Components and the corresponding Next.js advisory `GHSA-8h8q-6873-q5fj` ↗︎.\n\nCloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎, `GHSA-267c-6grr-h53f` ↗︎, and `GHSA-mg66-mrh9-m8jx` ↗︎. If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the WAF changelog. Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible.\n\nSeveral of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations.\n\nCustomers on Pro, Business, or Enterprise plans should ensure that Managed Rules are enabled.\n\n#### Next.js adapters\n\nVinext: Vinext ↗︎ is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` (PR #1118 ↗︎, PR #1112 ↗︎) to prevent accidentally running a vulnerable version of React with Vinext.\n\nOpenNext on Cloudflare: OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions (PR #1255 ↗︎).\n\n#### Summary of disclosed vulnerabilities\n\n| Advisory | Severity | Issue | WAF status |\n| --- | --- | --- | --- |\n| `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎ | High | Denial of service in Server Components | WAF rules in place: `2694f1610c0b471393b21aef102ec699`, `aaede80b4d414dc89c443cea61680354` Cloudflare is investigating additional managed WAF coverage |\n| `GHSA-267c-6grr-h53f` ↗︎ | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-mg66-mrh9-m8jx` ↗︎ | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-492v-c6pp-mqqv` ↗︎ | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-c4j6-fc7j-m34r` ↗︎ | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-36qx-fr4f-26g5` ↗︎ | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-ffhc-5mcf-pf4q` ↗︎ | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-gx5p-jg67-6x7h` ↗︎ | Moderate | XSS in `beforeInteractive` scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-h64f-5h5j-jqjh` ↗︎ | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-wfc6-r584-vfw7` ↗︎ | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-vfv6-92ff-j949` ↗︎ | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-3g8h-86w9-wvmq` ↗︎ | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior |","published_at":"2026-05-07T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}