Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
Original title: Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
Cloudflare released an emergency WAF ruleset update on October 25, 2026, for CVE-2026-111497. Two rules, enabled by default in Log mode, match requests with Content-Encoding: br and requests to the Next.js /_next/image endpoint. A match does not by itself show exploitation, and existing Block overrides can start blocking legitimate traffic immediately. Separate reporting describes the Node.js Brotli issue as an out-of-bounds write that could allow remote code execution, with demonstrated execution via crafted compressed data.
Unconfirmed: The item describes demonstrated code execution, not confirmed attacks against customer sites.
- Rule identifiers end in ca706f3c for Brotli requests and 402fe5bb for the image optimizer path.
- The rules do not match Accept-Encoding: br and do not change Cloudflare response compression.
- Reported affected Node.js lines are 22.x, 24.x, and 26.x.
- Fixed Node.js releases cited are 22.23.4, 24.22.1, and 26.12.1.
Impact: Possible remote code execution via crafted Brotli data
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x, and 26.x | 22.23.4, 24.22.1, and 26.12.1 |
- 1.Review Cloudflare ruleset action overrides before the new rules deploy.
- 2.Keep the new rules in Log mode until matching traffic is assessed.
- 3.Update affected Node.js runtimes to 22.23.4, 24.22.1, or 26.12.1.
- CVEs
- CVE-2026-111497
- Vendors
- Cloudflare
- Products
- Cloudflare WAFNode.jsNext.js
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next. js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.