{"id":"CVE-2026-23864","kind":"vulnerability","aliases":["CVE-2026-23864"],"related":[],"title":"React Server Components: denial of service via crafted requests in server packages","description":"WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF and framework adapter mitigations for React and Next.js vulnerabilities\n\nMultiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.\n\nWe strongly recommend updating your application and its dependencies immediately. Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`).\n\n#### WAF protections\n\nCloudflare WAF rules deployed in response to prior React Server Component CVEs (`CVE-2025-55184` ↗︎ and `CVE-2026-23864` ↗︎) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset.\n\n| Ruleset | Rule description | Rule ID | Default action |\n| --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2025-55184` ↗︎ | `2694f1610c0b471393b21aef102ec699` | Disabled |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2026-23864` ↗︎ | `aaede80b4d414dc89c443cea61680354` | Block |\n\nThe existing rules detect the underlying attack patterns generically. As a result, they apply to the new `CVE-2026-23870` ↗︎ denial-of-service vulnerability in Server Components and the corresponding Next.js advisory `GHSA-8h8q-6873-q5fj` ↗︎.\n\nCloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎, `GHSA-267c-6grr-h53f` ↗︎, and `GHSA-mg66-mrh9-m8jx` ↗︎. If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the WAF changelog. Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible.\n\nSeveral of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations.\n\nCustomers on Pro, Business, or Enterprise plans should ensure that Managed Rules are enabled.\n\n#### Next.js adapters\n\nVinext: Vinext ↗︎ is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` (PR #1118 ↗︎, PR #1112 ↗︎) to prevent accidentally running a vulnerable version of React with Vinext.\n\nOpenNext on Cloudflare: OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions (PR #1255 ↗︎).\n\n#### Summary of disclosed vulnerabilities\n\n| Advisory | Severity | Issue | WAF status |\n| --- | --- | --- | --- |\n| `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎ | High | Denial of service in Server Components | WAF rules in place: `2694f1610c0b471393b21aef102ec699`, `aaede80b4d414dc89c443cea61680354` Cloudflare is investigating additional managed WAF coverage |\n| `GHSA-267c-6grr-h53f` ↗︎ | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-mg66-mrh9-m8jx` ↗︎ | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-492v-c6pp-mqqv` ↗︎ | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-c4j6-fc7j-m34r` ↗︎ | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-36qx-fr4f-26g5` ↗︎ | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-ffhc-5mcf-pf4q` ↗︎ | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-gx5p-jg67-6x7h` ↗︎ | Moderate | XSS in `beforeInteractive` scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-h64f-5h5j-jqjh` ↗︎ | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-wfc6-r584-vfw7` ↗︎ | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-vfv6-92ff-j949` ↗︎ | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-3g8h-86w9-wvmq` ↗︎ | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior |","summary":"CVE-2026-23864 is a denial-of-service flaw in React Server Components, the react-server-dom packages that apps use to render on the server. An attacker who can send crafted requests to an affected server can make it hang or crash.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"facebook react","fixed":["19.0.4"],"affected":">= 19.0.0, < 19.0.4","ecosystem":"vendor"},{"name":"facebook react","fixed":["19.1.5"],"affected":">= 19.1.0, < 19.1.5","ecosystem":"vendor"},{"name":"facebook react","fixed":["19.2.4"],"affected":">= 19.2.0, < 19.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","managed-hosting","next.js","package","react","self-hosted","server-components"],"not_affected_if":["client-only-react","static-export"],"how_to_check":"- Run `npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack react-dom` in the app and compare against the fixed versions.\n- Check that `react` is not in the 19.0.x, 19.1.x or 19.2.x ranges below the fixed release.","fix":"- Upgrade the react-server-dom-* packages to `19.0.6` on the 19.0 line, `19.1.7` on the 19.1 line, or `19.2.6` on the 19.2 line.\n- Note: the source lists the fixed patch for the 19.0 branch as 19.0.4 in the product data and 19.0.6 in the changelog; use the newer one.\n- Upgrade Next.js to `15.5.16` or `16.2.5` if the app uses it.\n- Do not rely on a WAF rule alone; Cloudflare says some of these issues cannot be blocked at the WAF.","status":"open","published_at":"2026-01-26T19:27:15+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:57+00:00","updated_at":"2026-10-25T05:29:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the react-server-dom-* packages to `19.0.6` on the 19.0 line, `19.1.7` on the 19.1 line, or `19.2.6` on the 19.2 line.\n- Note: the source lists the fixed patch for the 19.0 branch as 19.0.4 in the product data and 19.0.6 in the changelog; use the newer one.\n- Upgrade Next.js to `15.5.16` or `16.2.5` if the app uses it.\n- Do not rely on a WAF rule alone; Cloudflare says some of these issues cannot be blocked at the WAF.","reach":"internet","title":"React Server Components: denial of service via crafted requests in server packages","impact":"medium","summary":"CVE-2026-23864 is a denial-of-service flaw in React Server Components, the react-server-dom packages that apps use to render on the server. An attacker who can send crafted requests to an affected server can make it hang or crash.","category":"package","nicknames":[],"who_cares":["react","next.js","server-components","self-hosted","managed-hosting"],"confidence":0.6,"needs_auth":"no","worst_case":"Server process hangs or crashes, causing a denial of service","analyst_note":"Check the React and Next.js advisories (GHSA IDs in the Cloudflare changelog) for the exact trigger conditions and whether the 19.0 patch is 19.0.4 or 19.0.6.","how_to_check":"- Run `npm ls react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack react-dom` in the app and compare against the fixed versions.\n- Check that `react` is not in the 19.0.x, 19.1.x or 19.2.x ranges below the fixed release.","needs_analyst":true,"not_affected_if":["client-only-react","static-export"],"who_is_affected":"Applications that run React Server Components on the server, including apps built on Next.js or other frameworks that bundle the react-server-dom packages. Client-only React apps that never use Server Components are not affected. Teams on managed hosting still need to confirm the framework version they deploy.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000987,"input_tokens":6076,"output_tokens":758,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':218C,276C '-2026':14A,17A,42B,222C,286C,308C,349C,659C '-23864':15A,18A,43B,223C,287C '-23870':309C,350C,660C '-55184':219C,277C '1112':560C '1118':558C '1255':648C '15.5.16':200C '16.2.5':202C '19.0.6':194C '19.1.7':195C '19.2.6':197C,549C '2026':106C '267c':358C '2694f1610c0b471393b21aef102ec699':278C '6873':326C,354C,664C '6grr':359C '7':105C '8h8q':325C,353C,663C 'aaede80b4d414dc89c443cea61680354':288C 'accident':563C 'across':156C 'action':245C,269C 'adapt':89C,110C,466C,578C,620C,635C 'add':390C,546C 'addit':391C 'advanc':413C 'advisori':322C,347C,653C 'affect':78B,128C,504C 'alreadi':224C 'announc':399C 'api':477C 'app':62B,584C 'appli':303C 'applic':167C,386C,441C,613C 'architectur':494C 'attack':70B,296C 'avail':175C 'behavior':387C 'block':244C,289C,433C 'boundari':538C 'break':385C 'busi':454C 'bypass':142C 'cach':153C 'changelog':96C,97C,403C 'cloudflar':25B,103C,205C,251C,270C,280C,328C,388C,410C,574C,587C,634C 'code':505C 'compon':3A,40B,54B,131C,215C,317C 'correspond':320C 'coverag':226C 'craft':8A,74B 'crash':85B 'creat':372C 'cross':149C 'cross-sit':148C 'custom':248C,257C,451C 'cve':13A,16A,41B,217C,221C,275C,285C,307C,348C,603C,658C 'cves':216C,380C,491C 'data':523C,535C 'data-rout':522C 'default':241C,268C 'defens':544C 'denial':4A,47B,136C,232C,311C,600C,667C 'denial-of-servic':46B,231C,310C,599C 'depend':170C 'deploy':208C,339C,582C 'descript':265C 'detect':293C 'differ':495C 'direct':594C 'disabl':279C 'disclos':121C,230C,427C,490C,651C 'disclosur':28B 'dom':59B,181C,186C,192C 'dos':274C,284C 'effect':338C 'enabl':239C,464C 'endpoint':525C 'ensur':459C 'enterpris':456C 'exampl':508C,639C 'exist':291C 'expos':519C 'extra':541C 'facebook':19A,21A,23A 'fixtur':637C 'flaw':50B 'forgeri':147C 'framework':88C,109C 'free':255C,260C 'generic':298C 'ghsa':324C,352C,357C,363C,662C 'ghsa-267c-6grr-h53f':356C 'ghsa-8h8q':323C,351C,661C 'ghsa-mg66-mrh9-m8jx':362C 'h53f':360C 'hang':83B 'harden':623C 'header':529C 'high':345C,666C 'high-sever':344C 'host':31B,37B 'id':267C 'immedi':171C 'implement':512C 'improv':101C 'includ':135C,254C 'init':556C 'intern':528C 'investig':330C,418C 'issu':155C,655C 'lab':27B 'lab-disclosur':26B 'later':551C 'latest':481C 'layer':542C 'let':580C 'level':161C 'm8jx':366C 'make':81B 'manag':30B,252C,261C,271C,281C,374C,392C,461C 'managed-host':29B 'may':104C 'mg66':364C 'middlewar':139C 'minim':412C 'mitig':90C,111C,378C,421C,450C 'mrh9':365C 'multipl':117C 'must':606C 'new':98C,306C,630C 'newli':229C 'next.js':32B,94C,115C,133C,199C,321C,465C,476C,498C,583C,609C 'nextj':534C 'notic':414C 'opennext':572C,575C,590C,615C 'packag':12A,33B,60B 'page':520C 'parcel':187C 'patch':172C,645C 'path':506C 'pattern':297C 'plan':256C,457C 'platform':589C 'plugin':472C 'poison':154C 'possibl':370C,423C,431C 'potenti':384C 'ppr':514C 'pr':557C,559C,647C 'prevent':562C 'prior':212C 'pro':453C 'protect':204C 'protocol':516C 'provid':225C 'proxi':141C 'pure':446C 'q5fj':327C,355C,665C 'rang':158C 'react':1A,20A,22A,24A,34B,52B,57B,92C,113C,124C,129C,177C,179C,184C,190C,213C,273C,283C,548C,569C,598C 'react-server-dom':56B 'react-server-dom-parcel':183C 'react-server-dom-turbopack':189C 'react-server-dom-webpack':178C 'recommend':164C,438C 'reimplement':474C 'releas':482C,628C 'reliant':447C 'render':65B 'request':9A,75B,146C,537C 'requir':552C 'respons':210C 'result':301C 'resum':515C 'rout':524C 'router':521C 'rule':207C,237C,264C,266C,292C,333C,376C,394C,396C,462C 'ruleset':253C,262C,263C,272C,282C 'run':554C,564C 'safe':336C 'script':151C 'se':669C 'secur':118C 'self':36B 'self-host':35B 'send':73B 'server':2A,11A,39B,53B,58B,68B,79B,130C,144C,180C,185C,191C,214C,316C 'server-compon':38B 'server-sid':143C 'servic':6A,49B,138C,234C,313C,602C 'sever':160C,346C,424C,654C 'share':408C 'side':145C 'sidestep':502C 'site':150C 'status':657C 'still':417C 'stock':497C 'strip':527C 'strong':163C,437C 'summari':649C 'surfac':478C 'team':125C,616C 'test':636C 'three':341C 'turbopack':193C 'under':295C 'updat':99C,165C,439C,607C,618C,642C 'use':63B,249C,258C,644C 'user':605C 'vector':626C 'vercel':127C 'version':173C,567C,610C,631C,646C 'via':7A 'vinext':467C,468C,479C,492C,555C,571C 'vite':471C 'vulner':95C,116C,119C,235C,314C,406C,428C,485C,566C,595C,652C 'waf':86C,107C,203C,206C,332C,375C,393C,402C,420C,435C,449C,656C 'way':500C 'webpack':182C 'whether':331C 'worker':588C 'x':533C 'x-nextjs-data':532C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":"Cloudflare Managed Ruleset rules ...61680354, ...dcdffcf8, and ...349edbc6 (React Server - DOS - CVE-2026-23864) for HTTP requests to Server Function endpoints proxied through Cloudflare; the 2026-04-15 release merged a beta rule into rule ID ...61680354 with action Block","since":"2026-01-26","covers":"The Cloudflare Managed Ruleset React Server DoS rules for CVE-2026-23864 (rule IDs ...61680354, ...dcdffcf8, and ...349edbc6), applied to requests to Server Function endpoints proxied through Cloudflare, with the April 15, 2026 release merging a beta rule into ...61680354 (action Block).","limits":"The rules do not replace official vendor updates to React; the January 26 changelog does not describe them as a permanent fix, and no other limits are stated.","source":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:27:17Z","sources":["https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/"],"confidence":0.9,"source_title":"WAF Release - 2026-04-15 · Changelog","customer_action":"Upgrade the affected react-server-dom packages to the official vendor fixed versions; the WAF rules are not a substitute for these updates."}],"who_affected":"Applications that run React Server Components on the server, including apps built on Next.js or other frameworks that bundle the react-server-dom packages. Client-only React apps that never use Server Components are not affected. Teams on managed hosting still need to confirm the framework version they deploy.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-26T19:27:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/#CVE-2026-23864","url":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/","severity":null,"published_at":"2026-05-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog"},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/#CVE-2026-23864","url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","severity":null,"published_at":"2026-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-15 · Changelog"},{"source":"nvd","external_id":"CVE-2026-23864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23864","severity":null,"published_at":"2026-01-26T20:16:16+00:00","modified_at":"2026-07-15T02:18:44+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/#CVE-2026-23864","url":"https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/","severity":null,"published_at":"2026-01-26T19:27:15+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-24T19:28:15+00:00","note":"Cloudflare: WAF Release - 2026-01-26 · Changelog"}],"documents":[{"id":2906,"url":"https://developers.cloudflare.com/changelog/post/2026-05-06-react-nextjs-vulnerabilities/","title":"Cloudflare: WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog","kind":"advisory","source":"lab","text":"WAF and framework adapter mitigations for React and Next.js vulnerabilities · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nMay 7, 2026\n\n## WAF and framework adapter mitigations for React and Next.js vulnerabilities\n\nMultiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.\n\nWe strongly recommend updating your application and its dependencies immediately. Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`).\n\n#### WAF protections\n\nCloudflare WAF rules deployed in response to prior React Server Component CVEs (`CVE-2025-55184` ↗︎ and `CVE-2026-23864` ↗︎) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset.\n\n| Ruleset | Rule description | Rule ID | Default action |\n| --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2025-55184` ↗︎ | `2694f1610c0b471393b21aef102ec699` | Disabled |\n| Cloudflare Managed Ruleset | React - DoS - `CVE-2026-23864` ↗︎ | `aaede80b4d414dc89c443cea61680354` | Block |\n\nThe existing rules detect the underlying attack patterns generically. As a result, they apply to the new `CVE-2026-23870` ↗︎ denial-of-service vulnerability in Server Components and the corresponding Next.js advisory `GHSA-8h8q-6873-q5fj` ↗︎.\n\nCloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎, `GHSA-267c-6grr-h53f` ↗︎, and `GHSA-mg66-mrh9-m8jx` ↗︎. If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the WAF changelog. Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible.\n\nSeveral of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations.\n\nCustomers on Pro, Business, or Enterprise plans should ensure that Managed Rules are enabled.\n\n#### Next.js adapters\n\nVinext: Vinext ↗︎ is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` (PR #1118 ↗︎, PR #1112 ↗︎) to prevent accidentally running a vulnerable version of React with Vinext.\n\nOpenNext on Cloudflare: OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions (PR #1255 ↗︎).\n\n#### Summary of disclosed vulnerabilities\n\n| Advisory | Severity | Issue | WAF status |\n| --- | --- | --- | --- |\n| `CVE-2026-23870` ↗︎ / `GHSA-8h8q-6873-q5fj` ↗︎ | High | Denial of service in Server Components | WAF rules in place: `2694f1610c0b471393b21aef102ec699`, `aaede80b4d414dc89c443cea61680354` Cloudflare is investigating additional managed WAF coverage |\n| `GHSA-267c-6grr-h53f` ↗︎ | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-mg66-mrh9-m8jx` ↗︎ | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule |\n| `GHSA-492v-c6pp-mqqv` ↗︎ | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-c4j6-fc7j-m34r` ↗︎ | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-36qx-fr4f-26g5` ↗︎ | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-ffhc-5mcf-pf4q` ↗︎ | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-gx5p-jg67-6x7h` ↗︎ | Moderate | XSS in `beforeInteractive` scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-h64f-5h5j-jqjh` ↗︎ | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-wfc6-r584-vfw7` ↗︎ | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior |\n| `GHSA-vfv6-92ff-j949` ↗︎ | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior |\n| `GHSA-3g8h-86w9-wvmq` ↗︎ | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior |","published_at":"2026-05-07T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":2921,"url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","title":"Cloudflare: WAF Release - 2026-04-15 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","published_at":"2026-04-15T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"},{"id":2943,"url":"https://developers.cloudflare.com/changelog/post/2026-01-26-waf-release/","title":"Cloudflare: WAF Release - 2026-01-26 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-01-26 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJanuary 26, 2026\n\n## WAF Release - 2026-01-26\n\nThis week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗︎).\n\nKey Findings\n\n- CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗︎) affects `react-server-dom-parcel`, `react-server-dom-turbopack`, and `react-server-dom-webpack` packages.\n- Attackers can send crafted HTTP requests to Server Function endpoints, causing server crashes, out-of-memory exceptions, or excessive CPU usage.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...61680354 | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...dcdffcf8 | N/A | React Server - DOS - CVE:CVE-2026-23864 - 2 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...349edbc6 | N/A | React Server - DOS - CVE:CVE-2026-23864 - 3 | N/A | Block | This is a new detection. |","published_at":"2026-01-26T19:27:15+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}