🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint. ⠀ The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution. It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases. ⠀ Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action. Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement. ⠀ Node.js users should update to: • 22.23.4 • 24.22.1 • 26.12.1 The WAF rules are an additional mitigation, not a replacement for patching.