{"id":"GHSA-9473-5f9j-94wq","kind":"vulnerability","aliases":["GHSA-9473-5f9j-94wq"],"related":[],"title":"WAF Release - 2026-07-29 · Changelog","description":"WAF Release - 2026-07-29 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 29, 2026\n\n## WAF Release - 2026-07-29\n\nThis release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.\n\nKey Findings\n\n- Nuxt Server Island - RCE(GHSA-9473-5f9j-94wq): An unauthenticated vulnerability in Nuxt Server Islands where remote attackers can supply arbitrary component names or props to endpoints. Manipulating these parameters allows unauthenticated component Remote Code Execution (RCE) on the server.\n- Alibaba Fastjson JSONType Remote Code Execution: A unauthenticated remote code execution vulnerability in Alibaba Fastjson (≤ 1.2.83) during JSON deserialization. Under default configurations, attackers can execute arbitrary system commands, bypassing traditional classpath and gadget-based defenses.\n- Generic Protections (SSRF & Command Injection): Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications, alongside new rules targeting obfuscated command injection patterns across request parameters.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Log | Block | This is an improved detection. |\n| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...7347c892 | N/A | Alibaba Fastjson JSONType Remote Code Execution - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8ec012ea | N/A | Nuxt Server Island - RCE | N/A | Block | This is a new detection.This was labeled as Generic Rules - RCE. |\n| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Generic Rules - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Generic Rules - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...1b7f9c67 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |","summary":"Nuxt Server Islands accept component names and props from remote requests without authentication. An attacker can use those parameters to run code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare","lab-disclosure","nuxt","runtime","self-hosted"],"not_affected_if":["no-server-islands"],"how_to_check":"- Check whether the application uses Nuxt Server Islands (`<NuxtIsland>` or server island components).\n- Check the installed Nuxt version with `npm ls nuxt` and compare it with the fixed version listed in the advisory (unknown in the sources).","fix":"- Upgrade Nuxt to the patched version listed in GHSA-9473-5f9j-94wq (version unknown in the sources).\n- If you use Cloudflare, confirm that the Managed Ruleset rule \"Nuxt Server Island - RCE\" (ID ...8ec012ea) is set to Block; this is a WAF mitigation, not a code fix.","status":"open","published_at":"2026-07-29T18:42:17+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:30:39+00:00","updated_at":"2026-10-25T05:30:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:30:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Nuxt to the patched version listed in GHSA-9473-5f9j-94wq (version unknown in the sources).\n- If you use Cloudflare, confirm that the Managed Ruleset rule \"Nuxt Server Island - RCE\" (ID ...8ec012ea) is set to Block; this is a WAF mitigation, not a code fix.","reach":"internet","title":"Nuxt: unauthenticated Server Island requests allow remote code execution","impact":"high","summary":"Nuxt Server Islands accept component names and props from remote requests without authentication. An attacker can use those parameters to run code on the server.","category":"runtime","nicknames":[],"who_cares":["nuxt","self-hosted","cloudflare"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands on the server without logging in.","analyst_note":"Find the patched Nuxt version and affected range in GHSA-9473-5f9j-94wq and confirm whether Server Islands are enabled by default.","how_to_check":"- Check whether the application uses Nuxt Server Islands (`<NuxtIsland>` or server island components).\n- Check the installed Nuxt version with `npm ls nuxt` and compare it with the fixed version listed in the advisory (unknown in the sources).","needs_analyst":true,"not_affected_if":["no-server-islands"],"who_is_affected":"Applications that use Nuxt Server Islands and expose their endpoints to remote requests are exposed. Sites that do not use Server Islands, or that are fully static, are unlikely to be affected. Exact affected Nuxt versions are unknown in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001211,"input_tokens":4407,"output_tokens":1540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-07':4A,56C,72C '-29':5A,57C,73C '-5':9A,15A,125C '-9473':8A,14A,124C '1.2.83':176C '1b7f9c67':391C '2026':3A,55C,68C,71C '29':67C '3590a4ad':316C '3a5b40d6':346C '7347c892':275C '761e7':259C '8ec012ea':294C '94wq':12A,18A,128C '9ab5ed95':376C '9c6dff1c':331C 'a4c':260C 'accept':31B 'across':226C 'action':237C,239C 'add':202C 'alibaba':96C,161C,174C,277C 'allow':151C 'alongsid':100C,218C 'applic':217C 'arbitrari':141C,186C 'attack':42B,138C,183C 'attempt':116C 'authent':40B 'base':195C 'beta':248C 'block':250C,266C,285C,301C,322C,337C,352C,367C,382C,397C 'bodi':283C 'bypass':189C 'c2e84e2d':244C 'cfe1a93c':361C 'changelog':6A,58C,59C 'classpath':191C 'cloud':104C,215C,247C 'cloud-host':214C 'cloudflar':19B,65C,241C,256C,272C,291C,313C,328C,343C,358C,373C,388C 'code':49B,155C,165C,170C,281C 'command':114C,188C,200C,223C,262C 'comment':240C 'compon':32B,94C,142C,153C 'configur':182C 'default':181C 'defens':196C 'descript':235C 'deseri':98C,179C 'detect':204C,255C,271C,290C,327C,342C,357C,372C,387C,402C 'detection.this':306C 'disclosur':22B 'endpoint':147C 'enhanc':101C 'execut':156C,166C,171C,185C,282C 'exist':81C 'f9j':11A,17A,127C 'f9j-94wq':10A,16A,126C 'fastjson':97C,162C,175C,278C 'file':348C,393C 'find':118C 'forgeri':110C,211C 'free':359C,374C,389C 'gadget':194C 'gadget-bas':193C 'generic':197C,310C,318C,333C,363C,378C 'ghsa':7A,13A,123C 'host':27B,216C 'id':231C,234C 'improv':63C,203C,254C 'inject':115C,201C,224C,263C 'introduc':76C 'island':30B,93C,121C,135C,298C 'json':178C 'jsontyp':163C,279C 'juli':66C 'key':117C 'lab':21B 'lab-disclosur':20B 'label':308C 'legaci':232C 'log':249C,265C,284C 'logic':205C 'manag':242C,257C,273C,292C,314C,329C,344C 'manipul':148C 'metadata':105C 'n/a':245C,261C,276C,295C,300C,317C,321C,332C,336C,347C,351C,362C,366C,377C,381C,392C,396C 'name':33B,143C 'new':60C,77C,219C,238C,270C,289C,305C,326C,341C,356C,371C,386C,401C 'nuxt':23B,28B,91C,119C,133C,296C 'obfusc':113C,222C,264C 'paramet':46B,150C,228C 'pattern':225C 'previous':236C 'prop':35B,145C 'protect':87C,102C,198C 'provid':85C 'rce':122C,157C,299C,312C,320C,350C,365C,395C 'releas':2A,54C,70C,75C 'remot':37B,137C,154C,164C,169C,280C 'request':38B,109C,210C,227C 'routin':99C 'rule':78C,220C,230C,233C,311C,319C,334C,364C,379C 'ruleset':229C,243C,258C,274C,293C,315C,330C,345C,360C,375C,390C 'run':48B 'runtim':24B 'self':26B 'self-host':25B 'server':29B,52B,92C,107C,120C,134C,160C,208C,297C 'server-sid':106C,207C 'side':108C,209C 'signatur':83C 'ssrf':111C,199C,212C,246C 'suppli':140C 'system':187C 'target':86C,206C,221C 'threat':82C 'tradit':190C 'unauthent':130C,152C,168C 'updat':61C,80C 'upload':349C,394C 'use':44B 'vulner':89C,131C,172C 'waf':1A,53C,69C 'without':39B 'xss':335C,380C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Nuxt Server Islands and expose their endpoints to remote requests are exposed. Sites that do not use Server Islands, or that are fully static, are unlikely to be affected. Exact affected Nuxt versions are unknown in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-29T18:42:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-07-29-waf-release/#GHSA-9473-5f9j-94wq","url":"https://developers.cloudflare.com/changelog/post/2026-07-29-waf-release/","severity":null,"published_at":"2026-07-29T18:42:17+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-07-29 · Changelog"}],"documents":[{"id":2875,"url":"https://developers.cloudflare.com/changelog/post/2026-07-29-waf-release/","title":"Cloudflare: WAF Release - 2026-07-29 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-07-29 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 29, 2026\n\n## WAF Release - 2026-07-29\n\nThis release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.\n\nKey Findings\n\n- Nuxt Server Island - RCE(GHSA-9473-5f9j-94wq): An unauthenticated vulnerability in Nuxt Server Islands where remote attackers can supply arbitrary component names or props to endpoints. Manipulating these parameters allows unauthenticated component Remote Code Execution (RCE) on the server.\n- Alibaba Fastjson JSONType Remote Code Execution: A unauthenticated remote code execution vulnerability in Alibaba Fastjson (≤ 1.2.83) during JSON deserialization. Under default configurations, attackers can execute arbitrary system commands, bypassing traditional classpath and gadget-based defenses.\n- Generic Protections (SSRF & Command Injection): Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications, alongside new rules targeting obfuscated command injection patterns across request parameters.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Log | Block | This is an improved detection. |\n| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...7347c892 | N/A | Alibaba Fastjson JSONType Remote Code Execution - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8ec012ea | N/A | Nuxt Server Island - RCE | N/A | Block | This is a new detection.This was labeled as Generic Rules - RCE. |\n| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Generic Rules - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Generic Rules - RCE | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |\n| Cloudflare Free Ruleset | ...1b7f9c67 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |","published_at":"2026-07-29T18:42:17+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}