Patterns build · 2026-10-21
OWASP Core Rule Set coreruleset/coreruleset@v4.30.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.
Coverage: 748 patterns across 22 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.
What changed since the previous release
No rule changed since the previous release (CRS v4.30.0).
The whole of it, per rule and per target, is in changes.json, attached to this release.
Backends
| Backend | Format | Bots | Archive | Size |
|---|---|---|---|---|
| Nginx | map + if
| 1870 | nginx_waf.zip
| 52K |
| Apache | ModSecurity | 1870 | apache_waf.zip
| 84K |
| Traefik | Middleware TOML | 1870 | traefik_waf.zip
| 20K |
| HAProxy | Pattern files | 1870 | haproxy_waf.zip
| 80K |
| Envoy | RBAC filter | 1870 | envoy_waf.zip
| 88K |
Quick install
curl -LO https://github.com/fabriziosalmi/patterns/releases/download/2026-10-21-crs-v4.30.0/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patternsIntegration guides → Nginx · Apache · Traefik · HAProxy · Envoy
What each target does with each rule
Of the 748 records in the CRS v4.30.0 intermediate representation, what each target does:
| Target | Full | Approximate | Unsound | Dropped |
|---|---|---|---|---|
| Nginx | 11 | 159 | 0 | 578 |
| Apache (ModSecurity) | 8 | 171 | 0 | 569 |
| Traefik | 1 | 2 | 0 | 745 |
| HAProxy | 7 | 172 | 0 | 569 |
| Envoy | 7 | 176 | 0 | 565 |
Why a record is dropped, by the first reason the backend found:
| Reason | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| an operator the backend cannot express | 294 | 294 | 294 | 294 | |
| matched on a request component the target does not have | 73 | 73 | 562 | 73 | 73 |
| part of a chain, and the target cannot require all of it | 127 | 127 | 127 | 127 | 127 |
| not a rule: it changes another rule | 55 | 55 | 55 | 55 | 55 |
| it refuses ordinary traffic once converted | 11 | 17 | 9 | 5 | |
| its severity is below what refuses, and the target cannot only record | 1 | 8 | 8 | ||
| longer than the target accepts | 15 | ||||
| it records and does not refuse | 3 | 3 | 3 | 3 |
What a written rule loses, in how many of them:
| Loss | Nginx | Apache (ModSecurity) | Traefik | HAProxy | Envoy |
|---|---|---|---|---|---|
| matched on other variables than the rule names | 153 | 166 | 2 | 172 | 176 |
| transformations the rule was written to run after are not applied | 122 | 121 | 2 | 120 | 124 |
The verdict for every rule and target is in coverage.json, attached to this release. How to read it.
Verify
This release is 2026-10-21-crs-v4.30.0, and it stays: releases are never deleted or replaced, so a link to this tag is a link to these files. Every file in it is signed by the workflow that built it, and attested. SHA256SUMS lists their hashes and is signed with the rest.
cosign verify-blob --bundle nginx_waf.zip.sigstore.json \
--certificate-identity https://github.com/fabriziosalmi/patterns/.github/workflows/update_patterns.yml@refs/heads/main \
--certificate-oidc-issuer https://token.actions.githubusercontent.com nginx_waf.zipEvery step, and how to pin to a release.
SHA-256
9b82939e978166103d7cd34a8ad077496acef312468c24daabba77f96509ba31 nginx_waf.zip
f721936a95d9f539b8997336f9df3cc4e4ade6bc2bf8c7f558e2c22c74164a02 apache_waf.zip
81e106838f85f88b2c13b2a6374097884983d646daf9571108a343718bfb3850 traefik_waf.zip
e5c8f00c853c4930fc299b0ba4082149a47a75fb4e613537e282f888799014e7 haproxy_waf.zip
bc2929be50b63a4a7749955c00c61c71696cb0e8d750efe9f3af3c86667cbff2 envoy_waf.zip
echo "9b82939e978166103d7cd34a8ad077496acef312468c24daabba77f96509ba31 nginx_waf.zip" | sha256sum -c -