Cloudflare has rolled out an urgent Web Application Firewall (WAF) ruleset update in response to a serious vulnerability in Brotli compression, tracked as CVE-2026-111497. The fix adds two new detection rules—one targeting Brotli-encoded request bodies and another focused on the Next.js image optimization endpoint. By default, both are set to Log mode, which only monitors traffic without blocking any requests. This gives customers visibility without risking disruption to live traffic.
What’s Vulnerable and What’s Changed
The first rule flags any incoming request that uses the “Content-Encoding: br” header, signaling that the body is Brotli compressed. It does not cover “Accept-Encoding: br,” which relates to how responses are compressed, not requests. The second rule detects requests made to Next.js’s /_next/image endpoint, commonly used for serving optimized images through Brotli compression. Most image requests via this endpoint are legitimate, but they now get logged for review.
Each of the new rules has a unique identifier: the Brotli request encoding rule ends with ca706f3c, and the Next.js image optimizer path rule ends with 402fe5bb. Both are tied to CVE-2026-111497. The vulnerable platforms include Node.js versions 22.x, 24.x, and 26.x. Security patches are already out—specifically versions 22.23.4, 24.22.1, and 26.12.1—that address the underlying memory flaw. These WAF updates act as an extra safeguard in the meantime.
Caution: Override Risks & Monitoring vs Blocking
An important nuance: many users have customized rule actions (overrides), some of which enforce Block by default. If one of the new rules is subject to such an override, it could inadvertently block valid Brotli-encoded requests or image traffic even before admins have fully reviewed logs. Cloudflare strongly advises checking existing overrides and ensuring that the new rules start in Log mode—allowing teams to assess impact through analytics before deciding whether blocking is needed.
Even with this ruleset update, runtime patching of Node.js remains essential. Every alert or log entry does not guarantee an exploit—normal traffic can trigger these rules. Treat spikes in matches as signals to investigate rather than proof of attack.
The vulnerability itself stems from a memory issue in Node.js’s Brotli decoder that could allow remote code execution via malformed compressed data. While the patches already released close that specific hole, the WAF changes offer a layer of protection until all affected systems are updated. Users are urged not to disable Brotli compression globally—unchanged response-compression settings remain safe.
Why it matters: Brotli is increasingly popular for compressing HTTP payloads, making this a high-impact vulnerability with potential for wide abuse—especially by attackers crafting malicious compressed requests. The update shows how CDN and edge providers are being pressed to adapt in real time.
Editorial Note: This update is emblematic of the “defense in depth” cybersecurity model: patching vulnerabilities is only part of the strategy. Monitoring, intelligently logging, and carefully configuring firewall rules are equally important. Teams should watch for legitimate traffic blocked due to overrides and plan for full adoption of patches, not just mitigation.
