Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Original title: Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-2026-111497
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
Cloudflare released an emergency Web Application Firewall update on October 25, 2026, adding two Managed Ruleset detections for the Brotli vulnerability CVE-2026-111497. Both rules are enabled in Log mode by default. One matches Content-Encoding: br request bodies; the other matches the Next.js /_next/image endpoint. Cloudflare says a match is not proof of exploitation and warns that a ruleset-level Block override could block traffic immediately. The announcement gives no affected versions, severity, prerequisites, or exploit details.
Unconfirmed: The announcement does not state affected versions, severity, or whether the flaw is being exploited.
- Rule suffix …ca706f3c matches Content-Encoding: br, not Accept-Encoding: br.
- Rule suffix …402fe5bb matches /_next/image, including legitimate image optimization.
- Blocking the image rule may stop optimized images from loading.
- Response-compression settings for Brotli are unchanged.
- Cloudflare suggests rule-specific Log overrides before switching either rule to Block.
- 1.Review matches before changing either new rule from Log to Block.
- 2.Check ruleset-level Block overrides so the new rules do not block immediately.
- 3.Assess apps that accept Brotli request bodies or use Next.js image optimization.
- CVEs
- CVE-2026-111497
- Vendors
- Cloudflare
- Products
- Cloudflare WAFNext.js
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at gbhackers.com
Cloudflare announced an emergency release of its Web Application Firewall (WAF) on October 25, 2026. This update introduces two detection rules for the Brotli vulnerability tracked as CVE-2026-111497. These rules specifically target requests that declare Brotli body encoding and traffic accessing the Next.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.