WAF WAF Release: Key Updates for 2025-11-10

This week’s release introduces new detections for Prototype Pollution across three common vectors: URI, Body, and Header/Form.

Key Findings

These attacks can affect both API and web applications by altering normal behavior or bypassing security controls.

Impact

Exploitation may allow attackers to change internal logic or cause unexpected behavior in applications using JavaScript or Node.js frameworks. Developers should sanitize input keys and avoid merging untrusted data structures.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	32405a50728746dd8caa057b606285e6	N/A	Generic Rules – Prototype Pollution – URI	Log	Disabled	This is a new detection
Cloudflare Managed Ruleset	a7da00c63c4243d2a72456fe4f59ff26	N/A	Generic Rules – Prototype Pollution – Body	Log	Disabled	This is a new detection
Cloudflare Managed Ruleset	833078bdcfa04bb7aa7b8fb67efbeb39	N/A	Generic Rules – Prototype Pollution – Header – Form	Log	Disabled	This is a new detection