WAF - WAF Release - 2025-08-29 - Emergency

This week's update

This week, new critical vulnerabilities were disclosed in Next.js’s image optimization functionality, exposing a broad range of production environments to risks of data exposure and cache manipulation.

Key Findings

• CVE-2025-55173: Arbitrary file download from the server via image optimization.

• CVE-2025-57752: Cache poisoning leading to unauthorized data disclosure.

Impact

Exploitation could expose sensitive files, leak user or backend data, and undermine application trust. Given Next.js’s wide use, immediate patching and cache hardening are strongly advised.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...9ff4bfe3100613Next.js - Dangerous File Download - CVE:CVE-2025-55173N/ABlockThis is a new detectionCloudflare Managed Ruleset...69b9ea7d100616Next.js - Information Disclosure - CVE:CVE-2025-57752N/ABlockThis is a new detection