CVE-2026-111497 (Node2Shell, HTTP2Shell, Brotli2Shell) is an out-of-bounds write in Google's C Brotli decoder, fixed in Brotli 1.2.1, in the CISA Known Exploited Vulnerabilities catalog since 2026-10-27. A crafted body sent with Content-Encoding: br can run code on servers that decompress request bodies, such as Express 5 on unpatched Node.js.
The new shield 1009, «Brotli Request Body», refuses with 403 and the block page every request that has a body whose Content-Encoding lists br, before it reaches your origin. Requests without a body, other encodings and responses are unchanged. A patched origin that legitimately receives Brotli bodies can get a WAF exception for rule_id 1009 on its path; rule_id 0 doesn't switch it off.
The edge doesn't cover the responses your own code fetches or traffic that reaches your origin directly. Update Node.js, Python brotli, PHP, .NET and libbrotli: see what the edge does and what you must still patch.
Shield events in security events now carry the shield's id as rule_id (until now 0), so you can filter them, for example by rule 1009.