The Managed Ruleset released today introduces two new detections: one for inbound requests that declare Content-Encoding: br and another for traffic targeting the /_next/image endpoint used by Next.js image optimization. Both rules are enabled automatically with an action of Log, meaning they will record matches but will not block traffic unless a user changes the action.
What Changed in the Managed Ruleset
- Brotli request‑encoding rule: Triggers on any request that includes the header
Content-Encoding: br. It does not fire onAccept-Encoding: brand does not interfere with Cloudflare’s own response‑compression features. - Next.js image optimizer rule: Fires for any request whose path matches
/_next/image. Legitimate image‑optimization calls are captured; switching the action to Block would stop those images from loading. - Both rules default to Log. No traffic is blocked out‑of‑the‑box.
Operational Impact
Because the rules start in logging mode, engineers can review match data in Cloudflare analytics before deciding on a stricter action. This approach reduces the risk of accidental service disruption while still surfacing potentially malicious traffic that uses Brotli‑encoded bodies or targets the Next.js optimizer.
However, the release warns that any existing ruleset‑level overrides that set Block for these rule IDs will take effect immediately once the rules are deployed. In environments where overrides are used to enforce a blanket block policy, the new detections could start rejecting legitimate requests without further notice.
Security Considerations
The underlying CVE (CVE‑2026‑111497) is tied to the Brotli request‑body handling. By logging matches, teams gain insight into whether attackers are attempting to exploit that vector. The Next.js rule addresses a separate surface: the image‑optimization endpoint, which could be abused for denial‑of‑service or content‑tampering if left unchecked.
Key points for security engineers:
- Review any global
Blockoverrides that reference the new rule IDs (e.g.,8f252673b69d47afb21f88acca706f3cand33dc63d3171649ed8f267455402fe5bb). - Correlate logged events with existing threat‑intel to determine if the traffic is benign or malicious.
- If blocking is required, apply the action at the rule level rather than a blanket override to avoid unintended side effects on unrelated traffic.
Related CloudNinjas coverage: security.
What This Means For Practitioners
AI, cloud, and DevOps teams should add the new rule IDs to their monitoring dashboards and verify that no existing overrides will automatically block traffic. Use the initial log data to assess exposure, then decide whether a rule‑specific Block is warranted. The change is low‑risk if the default logging is left untouched, but overlooking existing overrides could cause sudden service outages, especially for applications that rely on Next.js image optimization.
