Catch up on the essentials
- Cloudflare announced an emergency update to its Managed Ruleset on October 25, 2026, adding two web application firewall rules linked to CVE-2026-111497, a vulnerability in the Node.js Brotli decoder.
- Enabling blocking for the latter could interrupt image delivery, including requests from legitimate applications.
- Organizations that have already overridden these rules to Block may begin rejecting matching requests after the emergency update, even though Log is the new rules’ default action.
Selected from this article · 2026-10-27
Read on for the full pictureEmergency rules target Brotli and Next.js traffic
Cloudflare announced an emergency update to its Managed Ruleset on October 25, 2026, adding two web application firewall rules linked to CVE-2026-111497, a vulnerability in the Node.js Brotli decoder. One rule identifies requests using the `Content-Encoding: br` header, which declares a Brotli-compressed request body. The other targets requests sent to the Next.js image optimization endpoint at `/_next/image`.
The update is designed to provide visibility into traffic that may relate to the vulnerability. Cloudflare did not report confirmed exploitation in the reviewed announcement, and the release did not provide affected Node.js versions, fixed releases, exploitation prerequisites, a root-cause description or a severity score.
Logging is the default rather than blocking
Both new rules are enabled by default in Log mode, meaning they record matching requests without stopping them. Administrators can examine matching traffic through Cloudflare analytics before deciding whether to move either rule to Block mode.
That distinction matters because Cloudflare says the rules can also match legitimate traffic. The Brotli rule covers any request declaring Brotli request-body encoding, while the Next.js rule applies to the image optimization endpoint. Enabling blocking for the latter could interrupt image delivery, including requests from legitimate applications.
Existing overrides may change enforcement
Cloudflare warned customers to review existing ruleset-level action overrides. Organizations that have already overridden these rules to Block may begin rejecting matching requests after the emergency update, even though Log is the new rules’ default action.
For an observation-first approach, Cloudflare recommended applying rule-specific Log overrides, reviewing matching traffic and then considering a change to Block. The Brotli rule does not match the `Accept-Encoding: br` response-compression header and does not change Cloudflare’s Brotli response-compression settings.
Share this article
