Google Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, expose sensitive memory contents, cause a denial of service, or potentially run arbitrary code. Any application that decompresses untrusted Brotli data may be affected. This includes Node.js and Python applications that bundle the vulnerable decoder, and services that accept request bodies with the Content-Encoding: br header.
We strongly recommend upgrading Brotli to a patched version: 1.0.10, 1.1.1 or 1.2.1 (Brotli releases). If you use Node.js, upgrade to 22.23.4, 24.22.1 or 26.12.1 (Node.js security release).
If you can’t patch your applications right away, Azure WAF on Application Gateway and Azure Front Door can help mitigate the inbound attack vector, which is Brotli-compressed request bodies sent to your application.
Note: Azure WAF inspects only inbound requests to your application. It can’t protect applications that fetch and decompress Brotli-encoded responses from external servers. Those applications must be patched.
Built-in protection enabled by default
If you use Azure WAF with DRS 2.2, on Application Gateway or Azure Front Door Premium, you’re protected by default against the crafted requests we analyzed. Rule 920450 (Paranoia Level 1, enabled by default) checks requests against a list of restricted headers, and DRS 2.2 adds Content-Encoding to that list. The rule has a critical anomaly score, so a single match blocks the request when the WAF policy is in Prevention mode.
Earlier rule set versions don’t restrict this header. If you’re still on DRS 2.1, CRS 3.2 or earlier, we recommend upgrading to DRS 2.2 to get the latest protection. To learn how, see Upgrade CRS or DRS ruleset version.
Custom rule to mitigate CVE-2026-111497
We recommend the custom rule below for:
- WAF policies still on DRS 2.1 or earlier, while you plan the upgrade.
- WAF policies where rule 920450 is disabled or overridden.
- Azure Front Door Standard, which supports custom rules only. Managed rule sets require Azure Front Door Premium.
The custom rule blocks any request whose Content-Encoding header includes the br (Brotli) coding, which this attack uses. This rule may also block legitimate clients sending Brotli-compressed request bodies. If you aren’t sure whether your application accepts them, set the action to ‘Log traffic only’ first, and review your WAF logs before switching to ‘Deny traffic’. You can remove the rule once your applications are patched, or your policy is using DRS 2.2 to mitigate this attack.
Azure WAF on Application Gateway
Apply this rule on Azure WAF policy using CRS 3.2, DRS 2.1 or DRS 2.2 only. If you are using CRS 3.0 or CRS 3.1, upgrade your ruleset version to a later version first, then apply the custom rule.
{
“name”: “CVE2026111497”,
“priority”: 100,
“ruleType”: “MatchRule”,
“action”: “Block”,
“matchConditions”: [
{
“matchVariables”: [
{
“variableName”: “RequestHeaders”,
“selector”: “Content-Encoding”
}
],
“operator”: “Regex”,
“matchValues”: [ “(?:^|,)[ \\t]*br[ \\t]*(?:,|$)” ],
“transforms”: [ “Lowercase” ]
}
]
}
Azure WAF on Azure Front Door
{
“name”: “CVE2026111497”,
“priority”: 120,
“enabledState”: “Enabled”,
“ruleType”: “MatchRule”,
“action”: “Block”,
“matchConditions”: [
{
“matchVariable”: “RequestHeader”,
“selector”: “Content-Encoding”,
“operator”: “RegEx”,
“negateCondition”: false,
“transforms”: [ “Lowercase” ],
“matchValue”: [ “(?:^|,)[ \\t]*br[ \\t]*(?:,|$)” ]
}
]
}
Restrict request size
The proof-of-concept payloads analyzed so far are about 23 MB each. Attackers may be able to craft smaller payloads, so treat size limits as an extra layer of protection, not a mitigation on their own. Whatever rule set version you use, we recommend the following:
Azure WAF on Application Gateway and Application Gateway for Containers
The proof-of-concept payloads are well above the default maximum request body size of 128 KB on Application Gateway. We recommend setting the maximum request body size in your WAF policy to the smallest value your application needs. Learn more.
Azure WAF on Azure Front Door
To limit request body size, create a custom rule with a size constraint. For request body checks, the size is measured on the decoded body. Set the limit to the smallest value your application needs and make sure request body inspection is enabled in your WAF policy settings.
The following example blocks request bodies larger than 40 KB. This rule supports limits of up to 128 KB.
{
“name”: “BlockLargeRequestBody”,
“priority”: 130,
“enabledState”: “Enabled”,
“ruleType”: “MatchRule”,
“action”: “Block”,
“matchConditions”: [
{
“matchVariable”: “RequestBody”,
“operator”: “GreaterThan”,
“negateCondition”: false,
“matchValue”: [ “40960” ]
}
]
}
You can find more information about custom rules on Azure WAF for Application Gateway or for Azure Front Door.