Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability

Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability.

The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it.

The key detail is that this update adds monitoring, not automatic prevention. Customers using the ruleset defaults must review matching requests and choose whether to enable blocking.

Cloudflare also warns that existing action overrides could cause these new rules to block legitimate traffic immediately after deployment.

According to Cloudflare’s release notice, the Brotli rule matches incoming requests carrying the Content-Encoding: br header. This identifies requests declaring a Brotli-compressed body, including normal traffic from legitimate clients. A match therefore does not, by itself, show that someone attempted to exploit the vulnerability.

Cloudflare Release WAF Ruleset Update

The rule does not match Accept-Encoding: br, which is separate from the request-body header. Cloudflare also states that the update does not change its Brotli response-compression settings. Website owners should avoid treating this release as a general shutdown of Brotli compression across their sites.

The second rule matches requests to /_next/image, the Next.js image optimization endpoint. This includes legitimate image requests.

Switching its action to Block may stop optimized images from loading and disrupt image delivery for applications that depend on the endpoint. Its default Log action leaves those requests unblocked.

Cloudflare lists the new rules with identifiers ending in ca706f3c for Brotli request encoding and 402fe5bb for the Next.js image optimizer path. Both entries are described as new detections associated with CVE-2026-111497.

The update follows reports of a memory flaw in Node.js’s Brotli decoder. Cyber Security News previously covered Node.js security updates addressing Brotli and other vulnerabilities, identifying CVE-2026-111497 as an out-of-bounds write that could allow remote code execution.

The affected release lines include Node.js 22.x, 24.x, and 26.x. Separate reporting on the Node2Shell exploit describes demonstrated code execution through specially crafted Brotli-compressed data.

That coverage identifies Node.js 22.23.4, 24.22.1, and 26.12.1 as fixed releases. These updates address the vulnerable runtime, while Cloudflare’s rules provide an additional traffic control layer.

Cloudflare’s most important deployment warning concerns ruleset-level action overrides. An existing override that applies Block to these rules can take priority over their default Log setting. As a result, customers could block valid compressed requests or image traffic even when they expected monitoring only.

Cloudflare advises reviewing overrides before deployment and applying rule-specific Log overrides when teams want to assess traffic first. Customers can then inspect matches in analytics before deciding whether blocking is appropriate.

Since both rules also match normal requests, teams should assess application impact rather than treat every logged event as a confirmed attack. Runtime patching remains essential alongside any WAF configuration changes made in response to this emergency release.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability appeared first on Cyber Security News.