Back Developers.Cloudflare

WAF Release - 2026-08-26 - Emergency · Changelog

Developers.Cloudflare • August 26, 2026

This emergency release updates an existing .js remote code execution rule to identify CVE-2026-75604 and adds a new rule for remote code execution in the .js Image Optimizer via crafted AVIF images.

CVE-2026-75604 affects Windows-hosted .js applications using both the Pages Router and App Router without Cache Components and can lead to unauthenticated remote code execution.

GHSA-2xp9-vwfh-vxw4 affects the .js Image Optimizer and can lead to unauthenticated remote code execution when it optimizes an attacker-controlled AVIF image.

.js recommends updating to version 16.3.3 or 15.5.24 to address these vulnerabilities.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Next.js Security Release Addresses Critical Remote Code Execution Vulnerabilities Vercel disclosed two critical vulnerabilities in Next.js affecting applications using the AVIF image format and Windows servers. The first vulnerability, tracked as GHSA-2xp9-vwfh-vxw4, allows unauthenticated remote code execution via crafted AVIF inputs processed by the libheif library. The second vulnerability, CVE-2026-75604, affects Windows-hosted applications using the Pages Router and App Router without Cache Components, also enabling unauthenticated remote code execution. Vercel has patched these vulnerabilities in versions 16.3.3 and 15.5.24, and applications hosted on Vercel are not affected. Immediate upgrades are recommended for self-hosted applications, as no workarounds are available for the Windows vulnerability. The vulnerabilities were responsibly disclosed by security researchers, and Vercel has implemented protections to mitigate the risks. 6 sources 72

Extracted Entities

WAF Release - 2026-08-26 - Emergency · Changelog

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)