A security rule can record a request without stopping it. Check the effective action before treating a new detection as a deployed protection.
The emergency rules observe two different request patterns
Cloudflare’s October 25 emergency release announces two Cloudflare Managed Ruleset detections related to the Brotli decoder vulnerability CVE-2026-111497. Both use Log as their default action.
One matches request bodies declaring Content-Encoding: br. That differs from Accept-Encoding: br, which describes acceptable response encoding. The other matches the Next.js image optimization path, /_next/image.
Legitimate traffic can match either rule. The image-path detection can include ordinary optimized images, so a blanket blocking change may interrupt image delivery.
Inspect the action that your account actually applies
Cloudflare warns that an existing ruleset-level Block override can block matches despite the new rules’ Log defaults. Review effective overrides before assuming that the deployment only records traffic.
Check whether your account uses the named Cloudflare Managed Ruleset. The announcement does not establish that every plan or similarly named ruleset has identical coverage.
I would examine representative allowed requests and the matching analytics before changing an action. Keep the expected behavior for legitimate compressed uploads and image requests in that review.
The underlying fix predates this WAF notice
The Node.js security release dates the runtime response to October 21. It confirms an issue in the bundled Brotli decoder and credits OpenAI Codex Security researchers for reporting it.
Upstream Brotli releases also include the fix. Runtime-specific packages can bundle their own decoder, so confirm the patched release for the actual application.
Keep the discovery attribution separate from the patch record. A WAF event, a package update, and a verified application restart provide different evidence.
Close the runtime and traffic checks separately
- Identify the runtime and packaged dependencies serving the application.
- Confirm the applicable patched release or documented vendor backport.
- Review ruleset-level and rule-specific action overrides.
- Check representative legitimate requests against the effective rules.
- Verify application behavior after the relevant runtime change.
Use the result to document two outcomes: whether the application is patched, and whether the chosen traffic policy behaves as intended. Logging alone cannot answer the first question.
These are proposed checks. We have not assessed a reader’s deployment, tested exploitation, or changed any security rules.
Our PHP runtime update guide covers another case where a CMS version does not establish the server’s patch state. The GitHub AI Scan article distinguishes reported findings from verified remediation.
Sources
- Cloudflare rule defaults, matches and override warning
- Node.js affected release lines and security response
- Upstream Brotli security releases
Which record shows the effective rule action, and which shows that the runtime was patched?
Checked October 25, 2026. Prepared with AI-assisted research and drafting, with claims checked against the linked sources. MustHave.ai has not performed the proposed product tests.
