On October 25, 2026, Cloudflare published an emergency WAF release for its Managed Ruleset covering CVE-2026-111497, the Brotli decoder bug also known as Node2Shell. The release adds two rules, and both ship with the action set to Log. If you proxy traffic through Cloudflare, nothing is blocked until you decide it should be.
This is a Cloudflare WAF update worth reading before it deploys, because the two rules match ordinary traffic. The short version: watch the logs, check your overrides, and keep patching the runtimes behind the proxy.
Quick reference
| Question | Answer |
|---|---|
| What shipped? | Two new Managed Ruleset rules for CVE-2026-111497. |
| Default action? | Log for both. Matching requests are recorded, not blocked. |
| Brotli rule matches | Requests declaring Content-Encoding: br on the request body, including legitimate clients. |
| Next.js rule matches | Requests to /_next/image, including legitimate image traffic. |
| Does it touch response compression? | No. It does not match Accept-Encoding: br or change Brotli response settings. |
| Is it a substitute for patching? | No. See below. |
The two rules
| Rule | Description (Cloudflare's wording) | Default action |
|---|---|---|
...ca706f3c | Brotli - Request Content-Encoding - CVE:CVE-2026-111497 | Log |
...402fe5bb | Next.js - Image Optimizer Path - CVE:CVE-2026-111497 | Log |
Cloudflare lists both as new detections with no legacy rule IDs and no previous action. The changelog shows only the last eight characters of each ID, so find them in the dashboard by description.
Brotli request-body rule
The first rule fires on Content-Encoding: br, which means a client is sending a Brotli-compressed request body. That is rare compared with Brotli on responses, but it is legitimate, so a share of matches will be real clients. It does not match Accept-Encoding: br, the header browsers send to ask for compressed responses.
Next.js image optimizer rule
The second rule matches the path /_next/image, the endpoint a Next.js app uses to resize and re-encode images. Cloudflare's changelog does not explain why this path is tied to the CVE, and we will not guess at the mechanism. What it does say is that the rule catches legitimate image traffic and that setting it to Block "may stop optimized images from loading". On an image-heavy site, a Block here would be visible within minutes.
Why Log first is the right default
Both rules are broad on purpose: they flag a header and a path, not an exploit payload. Blocking on them would trade a decoder bug for a broken site. Logging lets you answer the question that matters before you enforce anything: does anything legitimate send Brotli request bodies to us, and how much /_next/image traffic do we serve?
A reasonable rollout:
- Open the Managed Ruleset and find both rules by their descriptions.
- Check for a ruleset-level override that sets rules to Block. Cloudflare warns that such an override can block matching requests on deployment despite the Log default.
- If you have one, add rule-specific overrides set to Log for these two rules first.
- Read the analytics for a few days. Zero legitimate
Content-Encoding: brrequests is a good case for a Block on that rule alone. - Leave the
/_next/imagerule on Log unless your app does not use the optimizer.
What a WAF rule does not cover
A WAF sees traffic between visitors and your origin. The Brotli bug is a flaw in the decoder, and decoders run in many places the proxy never sees. A server that fetches a URL, a CI job that downloads a package, or an AI agent's fetch tool all decode responses from servers they do not choose. Our affected-software guide lists fixed releases for Node.js, Bun, Python Brotli, Envoy, Istio and curl, and the Node.js October security release breakdown covers the 22.23.4, 24.22.1 and 26.12.1 builds.
Treat these Cloudflare rules as extra visibility while you patch, not as the fix. Update, restart (the decoder is bundled code), then confirm with the detection steps in the guide.
Where Beam fits
Beam does not sit in front of your web traffic and does not replace a WAF. It runs on your machine and records what coding agents do: shell commands, network tools, and changes to skill and MCP configuration. If an agent's runtime is one of the Brotli-affected ones, Beam helps you notice an unusual process or outbound connection after the fact. It does not inspect HTTP bodies or block Brotli payloads. For that, patch the runtime and use your edge rules.
What we could not confirm
- Why the
/_next/imagepath is tied to CVE-2026-111497: the changelog does not say. - Whether any attacks in the wild have triggered these rules. The post reports no detection data.
- The full rule IDs, which Cloudflare truncates in the changelog.
Related reading
- Brotli CVE-2026-111497: affected software, detection and fixes beyond Node.js
- Node.js October 2026 security release: MCP servers and agent tools
- What to do after an attack on your app: incident response playbook
- What is Tailscale and how to lock down a VPS with Cloudflare Tunnel
- PHP2Shell and AI agents: why the attack window collapsed
- October 2026 attacks timeline
Primary sources: Cloudflare WAF changelog, October 25, 2026 · Cloudflare WAF documentation · Node.js October 2026 security releases
Rule behavior is accurate as of October 26, 2026, per Cloudflare's changelog, and may change as Cloudflare updates the rules.