[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQf_nx7rOQAnYmw74SML6LrWy4GxH5rOKu6OBNrrCjsM":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c3e9f4d8-014d-4900-a7bf-1ea25c2ae9c2","Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability","cloudflare-release-emergency-waf-ruleset-update-following-brotli-vulnerability-85c39b","Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it. The key detail is that this update […] The post Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability appeared first on Cyber Security News.","Cloudflare has issued an emergency Web Application Firewall (WAF) ruleset update to address CVE-2026-111497, a Brotli vulnerability impacting Node.js. The update introduces two rules, one for Brotli-encoded request bodies and another for the Next.js image optimization endpoint, both enabled in Log mode by default. Cloudflare warns that existing action overrides could lead to immediate blocking of legitimate traffic and advises customers to review their configurations before enabling blocking.","Cloudflare releases emergency WAF rules for Brotli vulnerability CVE-2026-111497.","https:\u002F\u002Fcybersecuritynews.com\u002Fcloudflare-release-brotli-vulnerability-waf-ruleset\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FRelease-Emergency-WAF-ruleset-update-Following-Brotli-vulnerability.webp","2026-10-26T13:18:59+00:00","2026-10-26T14:00:11.315173+00:00",8,[17,20,23,25],{"name":18,"type":19},"Cloudflare","vendor",{"name":21,"type":22},"Web Application Firewall","product",{"name":24,"type":22},"Next.js",{"name":26,"type":22},"Node.js","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2026-111497","Brotli vulnerability impacting Node.js",[18,24,26],{"controls":52,"vendors":137},[53,81,109],{"slug":54,"name":55,"problem":56,"products":57},"patch-management","Automated patch management","Known holes get closed in days, not months.",[58,66,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":54,"product_name":70,"url":71,"description":72},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":44,"name":82,"problem":83,"products":84},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":110,"name":111,"problem":112,"products":113},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[114,121,129],{"vendor_slug":115,"vendor_name":18,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[138],{"slug":115,"name":18,"logo_path":116,"roles":139},[140],"reported_by",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":153},"cloudflare-emergency-waf-update-highlights-risks-of-brotli-vulnerability-in-nodejs","Cloudflare Emergency WAF Update Highlights Risks of Brotli Vulnerability in Node.js","A critical vulnerability (CVE-2026-111497) in the Brotli compression library affecting Node.js prompted Cloudflare to release an emergency WAF ruleset update, underscoring how widely-used dependencies can rapidly become attack vectors. The incident highlights the challenge of balancing immediate protection with operational risk, as enabling the new rules in blocking mode without review could inadvertently disrupt legitimate traffic. Customers who had previously configured action overrides were at particular risk of unintended consequences, demonstrating that WAF configurations must be continuously reviewed alongside any new threat signatures. This event reinforces that third-party library vulnerabilities in foundational components like compression libraries can have cascading impacts across entire application ecosystems.",[146,147,148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"PCI DSS Requirement 6":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"CIS Control 17: Incident Response Management":156,"OWASP A06:2021 Vulnerable and Outdated Components":157,"CIS Control 7: Continuous Vulnerability Management":158,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":159,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":160},"Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through patching and WAF controls, making both the Node.js patch and the careful rollout of the new WAF ruleset compliance obligations for in-scope environments.","SI-2 requires organisations to identify, report, and correct information system flaws in a timely manner; applying the Node.js Brotli patch directly would have complemented the WAF mitigation and reduced exposure.","Cloudflare's emergency ruleset release is itself an incident response action; customers without documented WAF change-management and incident response procedures were ill-prepared to assess the traffic impact before enabling blocking.","The Brotli library embedded in Node.js is precisely the type of vulnerable third-party component OWASP A06 targets, emphasising the need to track and update all software dependencies continuously.","Ongoing vulnerability scanning of Node.js dependencies would have identified CVE-2026-111497 promptly, enabling proactive patching before an emergency WAF update became necessary.","This control requires timely identification and remediation of technical vulnerabilities in software used by the organisation, directly applicable to managing the Brotli library flaw across the Node.js estate.","Although primarily an access control control, ensuring only reviewed and authorised WAF configurations are active falls under protective access governance, preventing unintended blocking of legitimate users caused by untested rule overrides."]