Cloudflare Patches Critical Brotli Compression Vulnerability in WAF

Key Takeaways

• Cloudflare has deployed an emergency Web Application Firewall (WAF) update to address a critical Brotli compression vulnerability, CVE-2026-111497.
• The update introduces two new WAF rules, initially set to “Log” mode, for monitoring Brotli-encoded requests and traffic to the Next.js image optimization endpoint.
• The vulnerability, an out-of-bounds write in Node.js’s Brotli decoder, could potentially enable remote code execution.
• While Cloudflare’s WAF rules provide an additional protective layer, the primary fix for the underlying vulnerability is through updated Node.js runtime versions.
• Customers must carefully review and potentially adjust WAF action overrides to avoid inadvertently blocking legitimate traffic.

Cloudflare has issued an urgent update for its Web Application Firewall (WAF) ruleset, responding to a significant vulnerability identified as CVE-2026-111497. This flaw is associated with Brotli compression and has prompted the immediate deployment of new protective measures.

Emergency WAF Ruleset Update Deployed

The update, released on October 25, 2026, introduces two distinct rules. These rules are designed to detect specific traffic patterns: one targets requests containing Brotli-encoded bodies, and the other focuses on traffic directed at the Next.js image optimization endpoint. By default, both rules are configured for “Log” mode, allowing Cloudflare customers to monitor matching traffic without immediately blocking it.

A crucial aspect of this deployment is that the new rules are initially set to monitor rather than prevent. This means that customers relying on the default WAF ruleset must actively review the logged requests and decide whether to enable blocking actions. Cloudflare also cautioned that pre-existing action overrides within customer WAF configurations could potentially cause these new rules to immediately block legitimate traffic upon deployment, necessitating careful review.

According to Cloudflare’s release notice, the Brotli rule specifically matches incoming requests that include the Content-Encoding: br header. This header indicates that the request body is compressed using Brotli. It is important to note that such a match does not inherently signify an attempted exploit, as legitimate clients frequently use Brotli compression. The rule does not, however, apply to the Accept-Encoding: br header, which is distinct and relates to response compression. Cloudflare explicitly stated that this update does not alter its Brotli response-compression settings, advising against treating this as a blanket directive to disable Brotli compression across websites.

The second rule targets requests made to the /_next/image path, which is the standard endpoint for Next.js image optimization. This endpoint also handles legitimate image requests. Enabling a “Block” action for this rule could disrupt image loading and delivery for applications that depend on this specific endpoint. The default “Log” action ensures that such requests remain unblocked.

Cloudflare has assigned specific identifiers to these new rules: the Brotli request encoding rule ends in ca706f3c, and the Next.js image optimizer path rule ends in 402fe5bb. Both are described as novel detections directly linked to CVE-2026-111497.

Understanding CVE-2026-111497

This WAF update follows earlier reports of a memory flaw within Node.js’s Brotli decoder. Previous security advisories for Node.js addressed various vulnerabilities, including CVE-2026-111497, which is characterized as an out-of-bounds write vulnerability. Such a flaw could potentially allow for remote code execution if exploited.

The vulnerability affects specific Node.js release lines, including versions 22.x, 24.x, and 26.x. Independent reports, particularly those concerning the “Node2Shell” exploit, have demonstrated successful code execution through specially crafted Brotli-compressed data. Patched versions addressing this runtime vulnerability include Node.js 22.23.4, 24.22.1, and 26.12.1. While these Node.js updates fix the underlying runtime issue, Cloudflare’s new WAF rules provide an additional layer of defense by controlling traffic at the network edge.

Critical Deployment Considerations for Cloudflare Customers

Cloudflare’s most significant warning pertains to existing ruleset-level action overrides. If a customer’s WAF configuration includes an override that applies a “Block” action to these new rules, it could supersede their default “Log” setting. This scenario could lead to the unintended blocking of valid compressed requests or legitimate image traffic, even when the customer expects only monitoring to be in effect.

Cloudflare strongly recommends that customers review all existing overrides before deploying these new rules. Teams wishing to assess traffic patterns initially should apply rule-specific “Log” overrides. This approach allows for careful inspection of matching requests in analytics before making an informed decision about whether to enable blocking. Given that both new rules can match normal, non-malicious requests, security teams should prioritize evaluating the potential impact on their applications rather than treating every logged event as a confirmed attack. Alongside any WAF configuration adjustments, applying the necessary runtime patches to Node.js remains a critical mitigation step.

What You Should Do

• Review WAF Overrides: Before the new rules become active, examine your Cloudflare WAF configuration for any existing action overrides that might inadvertently block legitimate Brotli-compressed requests or Next.js image traffic.
• Utilize Log Mode: Leverage the default “Log” action for the new rules (ending in ca706f3c and 402fe5bb) to monitor matching traffic without blocking. Analyze the logs to understand the volume and nature of affected requests.
• Patch Node.js Runtimes: Ensure all affected Node.js instances (22.x, 24.x, 26.x) are updated to their patched versions (e.g., Node.js 22.23.4, 24.22.1, 26.12.1) to address the underlying CVE-2026-111497 vulnerability.
• Assess Application Impact: Do not immediately assume logged events indicate an attack. Evaluate the impact of potential blocking on your applications before transitioning the WAF rules from “Log” to “Block” mode.
• Stay Informed: Continue monitoring Cloudflare’s advisories and Node.js security updates for any further information or mitigation recommendations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.