JA EN
shiichan

Emergency Response to Brotli CVE-2026-111497: Two New Cloudflare WAF Rules

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#web

Hi everyone, it's Shii-chan! Cloudflare just shipped an emergency WAF release, so here's a quick rundown!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog has an emergency WAF release (2026-10-25) for the Cloudflare Managed Ruleset. It adds two rules related to the Brotli vulnerability CVE-2026-111497.

The new rules are:

  • Brotli: request Content-Encoding header, CVE-2026-111497 (rule ID ending in ca706f3c)
  • Next.js: Image Optimizer path, CVE-2026-111497 (rule ID ending in 402fe5bb)

Both are new, and both default to the Log action.

Why it matters

Getting detection coverage right after a CVE is published is a big deal. That said, the post doesn't describe the vulnerability itself beyond its ID and its link to Brotli, so please check the official vulnerability advisory for details.

What changes

Zones using the Managed Ruleset will automatically log requests that match these rules.

  • Nothing is blocked, so legitimate traffic isn't suddenly cut off
  • You can review matching requests in analytics to evaluate the impact
  • You can switch either rule to Block on a per-rule basis

Dive Deep

Here is how the two rules behave.

  • Brotli rule: matches requests that declare Brotli request-body encoding (Content-Encoding: br), including legitimate clients that send Brotli-encoded bodies. It does not match Accept-Encoding: br, and it doesn't affect Cloudflare's Brotli response-compression settings
  • Next.js rule: matches requests to the Next.js image optimization endpoint /_next/image, including legitimate image optimization traffic. Setting it to Block may stop optimized images from loading and disrupt image delivery

Watch out for existing overrides. If you have a ruleset-level action override that applies Block to these rules, matching requests may be blocked as soon as the rules are deployed.

A safe way to evaluate:

  • Check for existing overrides that set Block
  • If needed, set rule-specific overrides to Log
  • Review the matches in analytics
  • Switch to Block only if you're comfortable with the results

Wrap-up

  • Two emergency rules for CVE-2026-111497 (Brotli) were added to the Cloudflare Managed Ruleset
  • The Brotli rule targets Content-Encoding: br request bodies; the Next.js rule targets /_next/image
  • Both default to Log and don't block anything
  • A ruleset-level Block override can cause immediate blocking, so double-check yours

If you run Cloudflare WAF, especially for a site using Next.js image optimization, go check your settings today!

Related posts