Cloudflare Adds Emergency WAF Rules for Brotli CVE-2026-111497

Emergency Release Adds Two Rules

Cloudflare has published an emergency WAF release dated October 25, 2026 for the Cloudflare Managed Ruleset. The release adds two rules related to the Brotli vulnerability CVE-2026-111497. Both rules are enabled by default, and their action is set to Log. In that default state, the rules provide visibility into matching requests so customers can evaluate the impact before choosing to block them.

The first rule is described as Brotli - Request Content-Encoding - CVE:CVE-2026-111497. Its rule ID is listed as …ca706f3c. The second rule is described as Next.js - Image Optimizer Path - CVE:CVE-2026-111497. Its rule ID is listed as …402fe5bb. The source describes both as new detections. The previous action for each is not available, and the new action is Log.

Rule Behavior and Defaults

The Brotli rule matches incoming requests that declare Brotli request-body encoding through Content-Encoding: br. This includes legitimate clients submitting Brotli-encoded request bodies. The rule does not match Accept-Encoding: br, and it does not affect Cloudflare's Brotli response-compression settings. Its default action is Log.

The Next.js rule matches requests to the Next.js image optimization endpoint /_next/image. This includes legitimate image optimization traffic. Its default action is Log, and it does not block requests. The release warns that changing the action to Block may prevent optimized images from loading and disrupt image delivery for applications using this endpoint.

When the ruleset defaults are used, both rules log matching requests without blocking them. Customers can review matches in analytics and configure a blocking action for either rule if desired. Enabling these rules in Log mode provides visibility only. It does not block requests matching these rules.

Action Overrides and Deployment Checks

The release highlights the importance of checking existing action overrides. If a ruleset-level action override applies Block to these rules, matching requests may be blocked as soon as the rules are deployed, despite their default Log action. This may result in false positives and block legitimate traffic. Customers should review their existing ruleset overrides before deployment.

For teams that want to evaluate the rules without blocking traffic, the release advises configuring rule-specific overrides to use Log and reviewing matching requests before switching to Block. This approach keeps the rules in a visibility mode while allowing teams to assess matches. The emergency release is part of the Cloudflare Managed Ruleset changelog for October 25, 2026.

Earlier coverage: Imperva Demonstrates Node2Shell RCE on Node.js via Crafted Brotli Data

Sources: Cloudflare · The Hacker News · Microsoft