WAF - WAF Release - 2025-12-10 - Emergency

This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns. Key Findings Enhanced detection logic for React – RCE – CVE-2025-55182, added Generic – Server Function Source Code Exposure, and added Generic – Server Function Resource Exhaustion. Impact These updates strengthen protection against React RCE exploitation attempts and broaden coverage for common server-function abuse techniques that may expose internal logic or disrupt application availability. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset bc1aee59731c488ca8b5314615fce168 N/A React - Remote Code Execution - CVE:CVE-2025-55182 - 2 N/A Block This is an improved detection. Cloudflare Free Ruleset cbdd3f48396e4b7389d6efd174746aff N/A React - Remote Code Execution - CVE:CVE-2025-55182 - 2 N/A Block This is an improved detection. Cloudflare Managed Ruleset 17c5123f1ac049818765ebf2fefb4e9b N/A Generic - Server Function Source Code Exposure N/A Block This is a new detection. Cloudflare Free Ruleset 3114709a3c3b4e3685052c7b251e86aa N/A Generic - Server Function Source Code Exposure N/A Block This is a new detection. Cloudflare Managed Ruleset 2694f1610c0b471393b21aef102ec699 N/A Generic - Server Function Resource Exhaustion N/A Disabled This is a new detection.