ContentsTap to jump to a section＋
- On October 25, 2026, Cloudflare announced an emergency Managed Ruleset release adding two rules related to Brotli vulnerability CVE-2026-111497. Both default to Log, so they do not block matching requests. Website and API operators should inspect their effective configuration while patching vulnerable application runtimes.
- Node.js released fixes on October 21 for its 22.x, 24.x and 26.x lines. The project rates the Brotli issue high: malformed compressed input can corrupt memory, potentially causing a crash, memory disclosure or remote code execution. Exposure requires the application to decompress attacker-controlled Brotli data.
Two new rules default to visibility rather than blocking
On October 25, 2026, Cloudflare announced an emergency Managed Ruleset release adding two rules related to Brotli vulnerability CVE-2026-111497. Both default to Log, so they do not block matching requests. Website and API operators should inspect their effective configuration while patching vulnerable application runtimes.
One rule matches Content-Encoding: br request bodies; the other matches Next.js image optimization requests at /_next/image. Both can match legitimate traffic. A match is not proof of an attack, and an enabled rule is not proof that remediation is complete.
A pre-existing ruleset action override can turn the new rules into blocking rules immediately upon deployment. Check existing overrides before allowing an older policy to apply to new detections.
The runtime patch remains necessary
Node.js released fixes on October 21 for its 22.x, 24.x and 26.x lines. The project rates the Brotli issue high: malformed compressed input can corrupt memory, potentially causing a crash, memory disclosure or remote code execution. Exposure requires the application to decompress attacker-controlled Brotli data.
Fixed Node.js releases are 22.23.4, 24.22.1 and 26.12.1. Vercel’s October 24 bulletin specifically includes self-hosted Next.js, container images, CI runners and development environments in its upgrade advice. A frontend package upgrade alone does not establish that the underlying Node.js process is patched.
This report covers Cloudflare’s October 25 change, separately from the October 21 runtime release. The reviewed sources describe exploitability and technical demonstrations; they do not establish a real-world compromise campaign through these newly announced rules.
Blocking broad matches can break image delivery
Content-Encoding describes request-body compression; Accept-Encoding advertises supported response encodings. Cloudflare states that its new Brotli rule does not match Accept-Encoding: br or change Brotli response-compression settings. Disabling all compression is not the action described by this release.
The Next.js path rule includes ordinary image optimization traffic. Blocking every match can stop optimized images from loading. Friday Works recommends checking product imagery, article images and mobile pages after changing policy, rather than relying solely on a successful homepage HTTP response.
The images are direct captures of Cloudflare’s October 25, 2026 notice, including its date and exact two new rule entries. They are vendor release documentation, not a WAF dashboard or customer configuration, and are not evidence that a website has been attacked or has enabled blocking.
Validate both remediation and service continuity
First, inventory Node.js services and their upgrade owners. Check the actual process serving requests, including containers and rarely visited hosts. Retain before-and-after build evidence; a package manifest can specify a minimum rather than the deployed patch version.
Next, check access to Managed Ruleset, deployment state and effective Cloudflare overrides. For an observation period, apply rule-specific Log overrides and examine matches before choosing a blocking policy. Do not assume all Cloudflare plans provide this ruleset or that all application traffic passes through it.
Finally, upgrade and restart or redeploy using a tested procedure, then validate image delivery, APIs and background jobs. An edge firewall covers traffic traversing its network; application-fetched responses may still be decompressed internally. Clean firewall logs therefore do not replace runtime patch verification.
References
Sources used in this guide
We prioritise official guidance and primary technical sources. Visit each source for full context and the latest updates.
- Emergency WAF release, October 25, 2026Cloudflare ↗︎
- Node.js October 21 security release, affected branches and vulnerability conditionsNode.js Project ↗︎
- October 24 bulletin: fixed Node.js releases, self-hosted Next.js and inbound/outbound limitsVercel Security Team ↗︎
- Original October 25, 2026 advisory capture: heading/date and exact Brotli/Next.js rule table; © Cloudflare, CC BY 4.0, original capture Friday Works; relevant crop, proportional resize and neutral margins, no data editsCloudflare / Friday Works ↗︎
- Cloudflare Docs content licence: CC BY 4.0; full notice retained locallyCloudflare ↗︎
- Creative Commons Attribution 4.0 termsCreative Commons ↗︎