Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default.
What Cloudflare added
The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that matches requests to the Next.js image optimization endpoint (/ _next/image). Both rules are enabled by default in Log mode so that teams can observe matches without automatically preventing traffic.
How the Brotli rule works
The Brotli-focused rule matches incoming requests carrying the Content-Encoding: br header, which identifies a Brotli-compressed request body. Cloudflare explicitly notes the rule does not match the Accept-Encoding: br header (which relates to response compression), and the update does not alter Brotli response-compression settings. Because the rule can match ordinary, legitimate clients that send Brotli-compressed bodies, a match alone is not proof of exploitation.
The Next.js image optimizer rule
The second detection targets requests to the /_next/image path used by Next.js image optimization. Because many legitimate applications rely on that endpoint for optimized images, switching the rule’s action to Block could stop optimized images from loading and disrupt image delivery. Leaving the rule in Log mode preserves normal image delivery while capturing events for review.
Identifiers, defaults, and overrides
Cloudflare lists the new rules using identifiers that end in ca706f3c for the Brotli request-encoding detection and 402fe5bb for the Next.js image-optimizer path. Although both rules default to Log, Cloudflare warns that preexisting ruleset-level action overrides can force a Block action immediately on deployment, potentially blocking valid compressed requests or image traffic. Customers are advised to review overrides and consider applying rule-specific Log overrides to assess traffic first.
Background on the vulnerability and runtime fixes
The WAF update follows reports of an out-of-bounds write in Node.js’s Brotli decoder that could allow remote code execution. This issue has been tracked as CVE-2026-111497 and demonstrated in exploit reporting such as the Node2Shell research. Node.js releases identified as containing fixes include 22.23.4, 24.22.1, and 26.12.1, covering the 22.x, 24.x, and 26.x lines respectively. Cloudflare’s rules aim to provide an additional traffic-control layer while runtime patching addresses the underlying vulnerable decoder.
Operational guidance from Cloudflare
Because both rules can match normal traffic, Cloudflare recommends that teams assess application impact rather than treating every logged match as an active attack. Review any ruleset-level overrides before enabling the update and use Log actions to gather analytics on matching traffic. Runtime patching remains essential; the WAF detections are intended as a complementary control. Finally, Cloudflare suggests giving SOC teams alert context to speed incident response and integrating available threat intelligence feeds.
Licensed under CC BY-ND 4.0 International