Cloudflare has published an emergency update to its Web Application Firewall (WAF) ruleset in response to CVE-2026-111497, a vulnerability in Brotli decoding.
Released on October 25, 2026, the update adds two new WAF rules: one that detects requests declaring a Brotli-compressed request body and another that targets requests to the Next.js image optimization endpoint. Both rules are enabled by default in Log mode so traffic that matches them is recorded but not blocked.
Importantly, this release enables monitoring rather than automatic mitigation. Customers who use the ruleset defaults must examine any matching requests and decide whether to switch a rule’s action to Block.
Cloudflare warns that existing ruleset-level action overrides can cause the new detections to block legitimate traffic immediately after deployment if those overrides set Block for the affected rules.
Details of the WAF update
The Brotli-related rule matches incoming requests that include the header Content-Encoding: br, which signals a Brotli-compressed request body; normal client traffic can include this header. A match therefore indicates the presence of a Brotli-compressed request body but does not by itself prove an exploit attempt. The rule does not inspect the Accept-Encoding: br header, which relates to response compression rather than the request body. Cloudflare also emphasized that this update does not change its Brotli response-compression settings, so site owners should not interpret the release as a blanket shutdown of Brotli on their sites.
The second rule targets requests to /_next/image, the Next.js image optimization endpoint, which will match legitimate image requests. Changing that rule’s action to Block can prevent optimized images from loading and disrupt image delivery for applications that rely on the endpoint; leaving it in the default Log action keeps those requests unblocked while they are monitored.
Cloudflare lists the new detections with identifiers ending in ca706f3c for Brotli request encoding and 402fe5bb for the Next.js image optimizer path. Both are described as new detections related to CVE-2026-111497.
The emergency ruleset update follows reports of a memory error in Node.js’s Brotli decoder. Prior coverage of Node.js security fixes identified CVE-2026-111497 as an out-of-bounds write that could enable remote code execution. The vulnerable release lines include Node.js 22.x, 24.x and 26.x; fixed releases are provided as Node.js 22.23.4, 24.22.1 and 26.12.1. Separate reporting on the so-called Node2Shell exploit demonstrated code execution using specially crafted Brotli-compressed data.
Cloudflare’s most critical deployment warning concerns ruleset-level action overrides. If an existing override sets Block for these rule identifiers, that override will take precedence over the rules’ default Log setting and can immediately block valid compressed requests or image traffic even when operators expect monitoring only.
Cloudflare recommends reviewing any overrides before enabling the rules and applying rule-specific Log overrides when teams want to observe matches first. Teams can inspect hits in analytics to assess whether blocking is warranted. Because both rules can match legitimate requests, operators should evaluate application impact rather than treating every logged match as a confirmed attack. Patching vulnerable runtimes remains essential in addition to any WAF adjustments made in response to this emergency release.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
