Cloudflare ships emergency WAF rules for the Brotli RCE bug
Two new managed rules flag Brotli-encoded request bodies and the Next.js image optimisation endpoint tied to CVE-2026-111497, but existing block overrides could trigger the moment they deploy.
Cloudflare pushed an emergency update to its Managed Ruleset on 25 October, adding two rules aimed at exploitation attempts against CVE-2026-111497, the Brotli decompression bug already patched in Node.js and flagged in Python, curl and Envoy. One rule matches requests that declare Content-Encoding: br on the request body; the other matches traffic to Next.js’s image optimisation endpoint, /_next/image, one of the paths attackers can use to trigger the bug.
Both rules are enabled by default, but only in Log mode, so Cloudflare can see who’s probing for the bug without blocking anyone outright. Cloudflare’s own warning is the sharpest detail here: if your account already has a ruleset-level override set to Block for these rule categories, matching requests may be blocked the moment the rules deploy, regardless of their default Log action. The Brotli rule only matches request bodies, not the Accept-Encoding: br header, so it won’t touch normal response compression.
Why it matters: anyone running Cloudflare in front of a Next.js app, or accepting Brotli-encoded uploads, should check their WAF override settings today rather than finding out the hard way that image optimisation or a legitimate upload path just started failing.
The caveat: Log mode gives you visibility, not protection. You still have to flip these rules to Block yourself once you’ve checked they don’t catch your own traffic.