WAF – WAF Release – 2025-12-11 – Emergency

This emergency release introduces rules for CVE-2025-55183 and CVE-2025-55184, targeting server-side function exposure and resource-exhaustion patterns, respectively.

Key Findings

Added coverage for Leaking Server Functions (CVE-2025-55183) and React Function DoS detection (CVE-2025-55184).

Impact

These updates strengthen protection for server-function abuse techniques (CVE-2025-55183, CVE-2025-55184) that may expose internal logic or disrupt application availability.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	17c5123f1ac049818765ebf2fefb4e9b	N/A	React – Leaking Server Functions – CVE:CVE-2025-55183	N/A	Block	This was labeled as Generic – Server Function Source Code Exposure.
Cloudflare Free Ruleset	3114709a3c3b4e3685052c7b251e86aa	N/A	React – Leaking Server Functions – CVE:CVE-2025-55183	N/A	Block	This was labeled as Generic – Server Function Source Code Exposure.
Cloudflare Managed Ruleset	2694f1610c0b471393b21aef102ec699	N/A	React – DoS – CVE:CVE-2025-55184	N/A	Disabled	This was labeled as Generic – Server Function Resource Exhaustion.

Source: Cloudflare

Latest Posts