Cloudflare WAF proactively protects against React vulnerability
Dec 3, 2025Daniele Molteni
Summary
This post details the deployment of new WAF rules to protect against a Remote Code Execution (RCE) vulnerability (CVE-2025-55182) in React Server Components (RSC) and related frameworks like Next.js. The rules are automatically applied to all traffic proxied through Cloudflare's WAF, including free and paid plans. Two specific rule IDs are provided for the Managed Ruleset and the Free Ruleset, both with a default 'Block' action. The post emphasizes that Cloudflare Workers are inherently immune to this exploit. It also strongly recommends customers update their React and Next.js versions.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack