Quick answer
The Cloudflare WAF has body inspection limits that depend on the plan: ~8 KB on Free, 128 KB on Enterprise. Classic bypass: fill the body with padding until you exceed the limit, and the payload that follows passes without inspection. Other vectors: header stuffing (>94-100 headers, OpenResty truncates), IP origin disclosure via Censys/historical DNS, cache poisoning with ignored headers, cache rule mismatch.
1. Body inspection limits
Cloudflare doesn't inspect the whole body. The limit depends on the target's plan:
| Plan | WAF inspection limit | Expandable? |
|---|---|---|
| Free | ~8 KB | No |
| Pro | Low by default | Yes, up to 1 MB via support |
| Business | Low by default | Yes, up to 1 MB via support |
| Enterprise | 128 KB | Yes, up to 1 MB via support |
History (December 2025)
Cloudflare tried to raise the limit to 1 MB for all plans on December 5, 2025 (because of CVE-2025-55182, React RCE). They reverted it because it caused a wave of false positives. They went back to the previous limits. Only paying customers who explicitly request it have 1 MB.
Practical implication: most sites on Cloudflare Free/Pro still have low limits. Same bypass as on AWS WAF.
2. Oversized body bypass — step by step
Keep reading the full chain
The remaining part includes the step-by-step PoC, exploitation code and the full chain that led to impact. Available to subscribers.
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Practice this in a lab
Waf Bypass
Keep learning · free account
Save your progress, unlock advanced payloads and rank your flags.
Related articles
Cloudflare WAF — payload size bypass, oversized body, plan-specific limits
Bypassing the Cloudflare WAF by exploiting body size limits per plan (Free 100kb, Pro 100kb, Business 500kb, Enterprise 1mb): oversize payload trick + chunked transfer encoding.
HTTP Request Smuggling — CL.TE, TE.CL, TE.TE and caching exploitation
When the frontend and the backend interpret the same request differently. Smuggling for auth bypass, cache poisoning, victim-aware attacks.
XSS WAF bypass — encoding, parser differentials, case-only mutations
WAF bypass techniques for XSS: HTML entities, hex/decimal/unicode encoding, parser differentials (browser vs WAF), comment injection, case variations, JS template literals.