Cloudflare released emergency WAF rules for CVE-2026-111497, covering Brotli-encoded requests and the Next.js image optimization endpoint.

Cloudflare announced an emergency update to its Cloudflare Managed Ruleset, adding two web application firewall rules for the Brotli vulnerability tracked as CVE-2026-111497.