Cloudflare ships automatic WAF rule for critical React RCE flaw
Cloudflare has rolled out new managed rules that block attempts to exploit a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). The protection is active for all customers whose React application traffic is proxied through Cloudflare’s WAF, including free and paid plans. Applications built on Cloudflare Workers are inherently immune to the flaw.
The underlying issue is tracked as CVE-2025-55182 with a CVSS score of 10.0. React versions 19.0, 19.1, and 19.2, alongside Next.js versions 15 through 16, insecurely deserialize malicious requests, enabling RCE. Cloudflare recommends updating to React 19.2.1 and to Next.js 16.0.7, 15.5.7, or 15.4.8 as a primary defense.
Rule deployment details
Cloudflare has set the default action for the new rules to Block. The rules are part of both the Cloudflare Free Managed Ruleset and the standard Cloudflare Managed Ruleset for paying customers.
The rule ID is as follows:
Ruleset | Rule ID | Default action |
|---|---|---|
Managed Ruleset | 33aa8a8a948b48b28d40450c5fb92fba | Block |
Free Ruleset | 2b5d06e34a814a889bee9a0699702280 | Block |
Customers on Professional, Business, or Enterprise plans must ensure Managed Rules are enabled; free-plan customers have them on by default.
Timeline and monitoring
The rules went live at 5:00 PM GMT on Tuesday, December 2, 2025. As of the publication of this post and the official CVE announcement, Cloudflare had observed no attempted exploits. The security team will continue to monitor traffic for attack variations and update the rules to prevent bypasses, having worked with partners to identify a broad set of attack patterns before release.
