InfoSecBulletin Cybersecurity for mankind
Cloudflare has shared an urgent update to its Web Application Firewall (WAF) rules due to CVE-2026-111497, a Brotli issue. The release on October 25, 2026 adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint. These are turned on by default in Log mode so that it can track matching traffic without stopping it.
This update adds monitoring but not automatic prevention. Customers using the default rules need to check matching requests and decide if it wants to enable blocking. Cloudflare also warns that existing action overrides could cause these new rules to block legitimate traffic immediately after deployment.
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
According to Cloudflare’s release notice, the Brotli rule fits requests that have the Content-Encoding: br header. This means they have a Brotli-compressed body. It includes normal traffic from real clients. So, just matching it does not mean someone is trying to exploit the weakness.
Cloudflare Release WAF Ruleset Update
The rule does not match Accept-Encoding: br, which is separate from the request-body header. Cloudflare also states that the update does not change its Brotli response-compression settings. Website owners should avoid treating this release as a general shutdown of Brotli compression across their sites.
The second rule matches requests to /_next/image, the Next.js image optimization endpoint. This includes legitimate image requests.
Switching its action to Block may stop optimized images from loading and disrupt image delivery for applications that depend on the endpoint. Its default Log action leaves those requests unblocked.
Cloudflare has new rules with IDs ending in ca706f3c for Brotli request encoding and 402fe5bb for the Next.js image optimizer path. Both of these are new detections linked to CVE-2026-111497.
The update follows reports of a memory flaw in Node.js’s Brotli decoder.
The affected release lines include Node.js 22.x, 24.x, and 26.x. Separate reporting on the Node2Shell exploit describes demonstrated code execution through specially crafted Brotli-compressed data.
That coverage lists Node.js versions 22.23.4, 24.22.1, and 26.12.1 as updated. These updates fix the weak runtime, and Cloudflare’s rules add another layer of traffic control.
Cloudflare’s key warning is about changes to rules. If an override is set to Block, it can override the usual Log setting. This means customers might block real requests or image traffic when they only wanted to track them.
Cloudflare suggests checking overrides before going live and using specific Log overrides to look at traffic first. Customers can review the matches in analytics before choosing to block anything.
Teams should look at how the changes affect the application instead of thinking every event logged is an attack. Runtime patching is still important along with any changes to WAF settings due to this emergency release.
