WAF - WAF Release - 2025-12-03 - Emergency

The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.

Key Findings

Rule description updated to reference React – RCE – CVE-2025-55182 while retaining existing unsafe-deserialization detection.

Impact

Improved classification and traceability with no change to coverage against remote code execution attempts.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...5fb92fbaN/AReact - RCE - CVE:CVE-2025-55182N/ABlockRule metadata description changed. Detection unchanged.Cloudflare Free Ruleset...99702280N/AReact - RCE - CVE:CVE-2025-55182N/ABlockRule metadata description changed. Detection unchanged.