WAF

This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns. Key Findings Enhanced detection logic for…

We are reinstating the maximum request-payload size the Cloudflare WAF inspects to the following values: FreeProfessionalBusinessEnterpriseWAF scans request payload up to:1 MB8 KB8 KB128 KB Key Findings On December 5, 2025, we initially attempted to increase the maximum WAF payload…

We are increasing the maximum request-payload size the WAF inspects to 1 MB across all plans. This enhancement strengthens our detection capabilities for React RCE (CVE-2025-55182) by ensuring the WAF can fully analyse React payloads up to their standard maximum…

The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged. Key Findings Rule…

This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization…

This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage. Key Findings CVE-2025-34299 is a critical remote code execution flaw in Monsta FTP, arising from…