Cloudflare has rolled out an urgent update to its Web Application Firewall (WAF) ruleset in response to a vulnerability identified as CVE-2026-111497, linked to Brotli compression.
Brotli Vulnerability and Monitoring Update
On October 25, 2026, Cloudflare introduced two new rules targeting Brotli-encoded request bodies and the image optimization feature of Next.js. These rules are preset to Log mode, allowing users to monitor the traffic without actively blocking it. The primary purpose of this update is to track potential vulnerabilities, leaving the decision to block such traffic in the hands of users.
Potential Risks and User Guidance
Cloudflare has highlighted that existing override actions could inadvertently result in these new rules blocking legitimate traffic once implemented. The Brotli rule identifies requests with a Content-Encoding: br header, which includes valid client requests. A match does not inherently indicate an exploitation attempt.
The second rule assesses requests directed to /_next/image, a Next.js image endpoint. While switching this rule to Block might hinder image loading, the default Log setting ensures these requests are observed but not obstructed. Cloudflare advises caution, noting that rule-specific Log overrides should be applied where necessary to prevent unintended disruptions.
Context of the Brotli Vulnerability
This update comes in the wake of a memory flaw discovered in the Brotli decoder of Node.js, which could potentially allow remote code execution. The affected versions include Node.js 22.x, 24.x, and 26.x, with patches available in specific releases such as 22.23.4, 24.22.1, and 26.12.1. These Node.js updates address the underlying runtime vulnerability, while Cloudflare’s WAF rules offer an additional layer of protection by monitoring traffic that might exploit this flaw.
Cloudflare emphasizes the importance of reviewing existing action overrides to ensure they do not conflict with the new rules. Users are encouraged to leverage Log mode for initial monitoring, allowing them to evaluate the traffic before deciding on any blocking actions. Given that these rules also flag legitimate requests, a careful assessment of their impact on applications is crucial.
In conclusion, while Cloudflare’s new WAF rules provide necessary oversight for Brotli-related vulnerabilities, they should be implemented thoughtfully alongside runtime patches to ensure a comprehensive security posture. As cyber threats evolve, staying vigilant and informed about such updates is essential for maintaining robust web security.
