Cloudflare WAF 2026-09-08：Next.
WAF - WAF Release - 2026-09-08
推荐理由
使用 Cloudflare WAF 保护 Next.js 应用的开发者必须关注此次变更，因为原本仅记录日志的 RCE 攻击现在会被直接阻断，可能导致误杀或业务逻辑异常，建议立即检查拦截日志并调整自定义规则。
This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.
本次发布通过将有活跃状态的 Beta 规则整合为基线签名，增强了针对 Next.js 远程代码执行（RCE）漏洞的现有规则的检测逻辑。
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...c76ba662 | N/A | Next.js - Image Optimizer Remote Code Execution via Crafted AVIF - Beta | Log | Block | This rule is merged into the original rule "Next.js - Image Optimizer Remote Code Execution via Crafted AVIF" (ID: ...80256efe). |
| Cloudflare Managed Ruleset | ...208457cf | N/A | Next.js - Remote Code Execution - CVE:CVE-2026-75604 - Beta | Log | Block | This rule is merged into the original rule "Next.js - Remote Code Execution - CVE:CVE-2026-75604" (ID: ...2ca6cce3). |
| 规则集 | 规则 ID | 旧版规则 ID | 描述 | 先前操作 | 新操作 | 备注 |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...c76ba662 | N/A | Next.js - Image Optimizer 远程代码执行（通过构造的 AVIF）- Beta | 记录日志 | 阻止 | 此规则已合并至原始规则“Next.js - Image Optimizer 远程代码执行（通过构造的 AVIF）”（ID: ...80256efe）。 |
| Cloudflare Managed Ruleset | ...208457cf | N/A | Next.js - 远程代码执行 - CVE:CVE-2026-75604 - Beta | 记录日志 | 阻止 | 此规则已合并至原始规则“Next.js - 远程代码执行 - CVE:CVE-2026-75604”（ID: ...2ca6cce3）。 |
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力