Next.js vulnerabilities trigger Cloudflare warning

This is a textbook layered-defense story: edge mitigation buys time, but the real fix still lives in the framework/runtime layer.

• –The blast radius sits in Next.js App Router and React Server Components, so teams using RSC need to inventory affected versions now.
• –Cloudflare’s managed rules help only when traffic is actually going through its WAF, so direct-origin deployments do not get that safety net.
• –Repeated RSC security issues are turning server components into an ongoing security tax for the ecosystem.
• –If you run Next.js, treat this as an upgrade-and-verify event, not a “WAF handled it” event.