WAF Release: New F5 BIG-IP Overflow Detection and Command Injection Enhancements
This release adds a new detection for CVE-2026-94127, a heap-based buffer overflow vulnerability in F5 BIG-IP that could allow arbitrary code execution. It also enhances command injection protections by merging tested beta logic into the baseline rule, and refines rule metadata for Next.js cache poisoning detection.
This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.
Key Findings
- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...a056caff | N/A | Command Injection - Generic 8 - uri - Beta | Log | Block | This rule is merged into the original rule "Command Injection - Generic 8 - uri" (ID: ...ee159e2e). |
| Cloudflare Managed Ruleset | ...7206c737 | N/A | F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...549f7356 | N/A | Next.js - Cache Poisoning - CVE:CVE-2026-94543 | Block | Block | Rule metadata description refined. Detection unchanged. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Persistent browser tool in Agents SDK with tabs and logins
The Cloudflare Agents SDK now includes a browserTool that allows agents to maintain a persistent browser session across multiple turns, preserving tabs, cookies, and login sessions. The browser remains alive even when the Durable Object hibernates, with a 10-minute idle timeout before creating a fresh session.
Cloudflare API MCP server sends Workers Issues as MCP Events
The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.
Web Analytics: Deeper Core Web Vitals Diagnostics with LCP & INP Sub-Part Metrics
Real User Monitoring in Web Analytics now breaks down Largest Contentful Paint (LCP) and Interaction to Next Paint (INP) into their constituent phases, plus splits connection time into TCP and TLS components. These sub-part metrics are available in the dashboard and queryable through the GraphQL Analytics API to help identify which specific area is impacting page performance.