// CloudflareHIGH
Cloudflare released emergency WAF rules on October 25, 2026, to protect against CVE-2026-111497, a critical Node.js Brotli vulnerability. Two new managed rules detect requests with Brotli encoding and traffic to Next.js image optimization endpoints, defaulting to logging rather than blocking to avoid false positives. Organizations should review rule actions and matching traffic before enabling enforcement.
- Cloudflare Releases Emergency WAF Rules for Critical Node.js Bro(opens in a new tab)
- Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-20(opens in a new tab)
- Brotli2Shell: Google Brotli decoder (CVE-2026-111497) | Tenable®(opens in a new tab)
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Br(opens in a new tab)
- Brotli bug reaches far beyond Node.js (CVE-2026-111497) - Help N(opens in a new tab)
- U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaw(opens in a new tab)
// Get alerts for Cloudflare