Cloudflare moves Next.js RCE defenses into baseline WAF rules

Cloudflare has moved two managed WAF detections for critical Next.js remote-code-execution paths from beta into baseline signatures. The September 8 release covers AVIF image-optimization attacks and CVE-2026-75604, an unauthenticated RCE issue affecting a specific Windows-hosted Next.js configuration.

The edge rule change improves protection for Cloudflare customers, but it does not repair vulnerable applications. Next.js users should still upgrade to the fixed releases and verify whether their deployment matches the affected conditions.

Cloudflare’s September 8 WAF change

Cloudflare says the release consolidates two active beta rules into the original baseline detections. One covers unauthenticated RCE through attacker-controlled AVIF images handled by the Next.js Image Optimization API. The other covers CVE-2026-75604, which targets applications using both the Pages Router and App Router without Cache Components on a Windows filesystem.

The practical difference is rule lifecycle and enforcement consistency: the protections no longer sit only in beta signatures. Cloudflare’s changelog identifies the affected managed rules and shows the promotion as a detection-logic update, rather than announcing a new application patch.

What Next.js operators still need to patch

Next.js published its August 2026 security release on August 25. Check Point’s independent advisory likewise lists 16.3.3 and 15.5.24 as the fixed release lines and describes the CVE as a directory-traversal path that can expose private build data. The Windows-hosted RCE does not affect Linux or macOS according to the vendor guidance, but teams often run mixed operating systems across development, CI, and production.

The AVIF issue is broader for deployments that optimize attacker-controlled images. Next.js says the patched releases disable AVIF optimization until the upstream libheif fix is propagated. Applications that accept uploaded images or remote image URLs should review that path specifically.

Edge protection is a detection layer, not remediation

Cloudflare’s managed WAF can provide a useful control while teams inventory applications and complete upgrades. Check that the relevant managed ruleset is enabled, inspect the action currently applied to each rule, and review events for false positives and attempted exploitation. A WAF match also deserves investigation: it may show probing against an exposed application even when the request was blocked.

Do not treat the baseline promotion as evidence that every Next.js deployment is safe. A deployment can be outside Cloudflare, use a different proxy configuration, or remain vulnerable at the application layer after an edge request is filtered. Patch status, runtime exposure, and filesystem conditions remain the decisive checks.

Source check and next milestone

Cloudflare’s September 8 changelog documents the beta-to-baseline promotion and names the two managed detections. Check Point’s independent advisory confirms the CVE, affected version ranges, and fixed releases. Together, the sources support the operational conclusion: enable and review the WAF coverage, then upgrade affected Next.js applications to 16.3.3, 15.5.24, or the later fixed release available for your branch.

For teams turning this into a repeatable maintenance workflow, LinkLoot’s AI workflow automation guide is relevant to the inventory and verification steps. The immediate deadline is operational rather than calendar-based: patch before an exposed application receives a successful exploit attempt.