# Emergency Response to Brotli CVE-2026-111497: Two New Cloudflare WAF Rules

Hi everyone, it's Shii-chan! Cloudflare just shipped an emergency WAF release, so here's a quick rundown!

## What was announced?

Cloudflare's Changelog has an emergency WAF release (2026-10-25) for the Cloudflare Managed Ruleset. It adds two rules related to the Brotli vulnerability CVE-2026-111497.

The new rules are:

- Brotli: request `Content-Encoding` header, CVE-2026-111497 (rule ID ending in `ca706f3c`)
- Next.js: Image Optimizer path, CVE-2026-111497 (rule ID ending in `402fe5bb`)

Both are new, and both default to the Log action.

## Why it matters

Getting detection coverage right after a CVE is published is a big deal. That said, the post doesn't describe the vulnerability itself beyond its ID and its link to Brotli, so please check the official vulnerability advisory for details.

## What changes

Zones using the Managed Ruleset will automatically log requests that match these rules.

- Nothing is blocked, so legitimate traffic isn't suddenly cut off
- You can review matching requests in analytics to evaluate the impact
- You can switch either rule to Block on a per-rule basis

## Dive Deep

Here is how the two rules behave.

- **Brotli rule**: matches requests that declare Brotli request-body encoding (`Content-Encoding: br`), including legitimate clients that send Brotli-encoded bodies. It does not match `Accept-Encoding: br`, and it doesn't affect Cloudflare's Brotli response-compression settings
- **Next.js rule**: matches requests to the Next.js image optimization endpoint `/_next/image`, including legitimate image optimization traffic. Setting it to Block may stop optimized images from loading and disrupt image delivery

Watch out for existing overrides. If you have a ruleset-level action override that applies Block to these rules, matching requests may be blocked as soon as the rules are deployed.

A safe way to evaluate:

- Check for existing overrides that set Block
- If needed, set rule-specific overrides to Log
- Review the matches in analytics
- Switch to Block only if you're comfortable with the results

## Wrap-up

- Two emergency rules for CVE-2026-111497 (Brotli) were added to the Cloudflare Managed Ruleset
- The Brotli rule targets `Content-Encoding: br` request bodies; the Next.js rule targets `/_next/image`
- Both default to Log and don't block anything
- A ruleset-level Block override can cause immediate blocking, so double-check yours

If you run Cloudflare WAF, especially for a site using Next.js image optimization, go check your settings today!