WAF - WAF Release - 2025-12-10 - Emergency

This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns.

Key Findings

Enhanced detection logic for React – RCE – CVE-2025-55182, added Generic – Server Function Source Code Exposure, and added Generic – Server Function Resource Exhaustion.

Impact

These updates strengthen protection against React RCE exploitation attempts and broaden coverage for common server-function abuse techniques that may expose internal logic or disrupt application availability.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...15fce168N/AReact - Remote Code Execution - CVE:CVE-2025-55182 - 2N/ABlockThis is an improved detection.Cloudflare Free Ruleset...74746affN/AReact - Remote Code Execution - CVE:CVE-2025-55182 - 2N/ABlockThis is an improved detection.Cloudflare Managed Ruleset...fefb4e9bN/AGeneric - Server Function Source Code ExposureN/ABlockThis is a new detection.Cloudflare Free Ruleset...251e86aaN/AGeneric - Server Function Source Code ExposureN/ABlockThis is a new detection.Cloudflare Managed Ruleset...102ec699N/AGeneric - Server Function Resource ExhaustionN/ADisabledThis is a new detection.