WAF - WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset

<p>This emergency release will add two rules related to the Brotli vulnerability <strong>CVE-2026-111497</strong> to the Cloudflare Managed Ruleset. Both rules will be <strong>enabled by default</strong> with their action set to <strong>Log</strong>, providing visibility into matching requests so customers can evaluate the impact before choosing to block them.</p> <p><strong>Rule behavior</strong></p> <ul> <li><strong>Brotli rule:</strong> Matches incoming requests that declare Brotli request-body encoding (<code>Content-Encoding: br</code>), including legitimate clients submitting Brotli-encoded request bodies. It does not match <code>Accept-Encoding: br</code> or affect Cloudflare's Brotli response-compression settings. The rule's default action is <strong>Log</strong>.</li> <li><strong>Next.js rule:</strong> Matches requests to the Next.js image optimization endpoint (<code>/_next/image</code>), including legitimate image optimization traffic. The default action is <strong>Log</strong> and does not block requests. Changing the action to <strong>Block</strong> may prevent optimized images from loading and disrupt image delivery for applications using this endpoint.</li> </ul> <p><strong>Default behavior</strong></p> <ul> <li>Both rules will log matching requests without blocking them when the ruleset defaults are used.</li> <li>Customers will be able to review matches in analytics and configure a blocking action for either rule if desired.</li> <li>Enabling these rules in <strong>Log</strong> mode provides visibility only; it does not block requests matching these rules.</li> </ul> <p><strong>Important: Check existing action overrides</strong></p> <p>If you have configured a ruleset-level action override that applies <strong>Block</strong> to these rules, matching requests may be blocked as soon as the rules are deployed, despite their default <strong>Log</strong> action. This may result in false positives and block legitimate traffic.</p> <p>Review your existing ruleset overrides before deployment. If you want to evaluate these rules without blocking traffic, configure rule-specific overrides to use <strong>Log</strong> and review matching requests before switching to <strong>Block</strong>.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="8f252673b69d47afb21f88acca706f3c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 8f252673b69d47afb21f88acca706f3c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ca706f3c</span></button></span></td><td>N/A</td><td>Brotli - Request Content-Encoding - CVE:CVE-2026-111497</td><td>N/A</td><td>Log</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="33dc63d3171649ed8f267455402fe5bb"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 33dc63d3171649ed8f267455402fe5bb" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...402fe5bb</span></button></span></td><td>N/A</td><td>Next.js - Image Optimizer Path - CVE:CVE-2026-111497</td><td>N/A</td><td>Log</td><td>This is a new detection.</td></tr></tbody></table>