On this page
Atomicorp WAF Rule 340362
Rule Summary
- Rule ID: 340362
- Status: Active
- Alert message: Atomicorp.com WAF Rules: ModSecurity does not support content encodings and can not detect attacks using it, therefore it must be blocked.
- Observed CWEs: CWE-78 (2), CWE-252 (1), CWE-269 (1), CWE-284 (1), CWE-787 (1)
- Revision: 5
- Rule severity: Error (3)
- Phase: 1 (request headers)
- Request surfaces: Request headers
- Rule action: deny
- HTTP status: 501
- Logging: log, auditlog
Description
Rule 340362 refuses compressed request bodies. This control provides protection against the reviewed attack vector for the Google Brotli decoder vulnerability CVE-2026-111497 , including its impact on Node.js.
The association is based on manual engineering review of the published vulnerability and the existing blocking rule. No new CVE-specific rule is required. No CVE-specific PoC or exploit replay was performed for this finding.
Alert interpretation
The rule’s action is to deny the matching request with HTTP 501 and record an alert. An alert records blocked activity; it does not establish that exploitation succeeded.
Recommended action
Keep Atomicorp rules current. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and Google Brotli libraries to 1.0.10, 1.1.1 or 1.2.1 for the applicable maintained branch, or a later fixed release. Apply the package vendor’s guidance and restart updated services.
Contact Atomicorp Support for help investigating alerts or application compatibility. Include rule ID 340362, application and runtime versions, and a sanitized alert. Keep deployment-specific investigation and tuning in the private support channel, and remove credentials and personal information before sharing evidence.
References
- Node.js: October 2026 security releases (opens in a new tab)
- GitHub Advisory Database: GHSA-9v8h-qqgm-4m35 (opens in a new tab)
- CVE record: CVE-2026-111497 (opens in a new tab)
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2022-26318 | WatchGuard XTM Firebox Unauthenticated Remote Command Execution | fireware | 9.8 (v3.1) | Critical |
| CVE-2022-31814 | pfSense plugin pfBlockerNG unauthenticated RCE as root | pfblockerng | 9.8 (v3.1) | Critical |
| CVE-2026-111497 | Node.js / Google Brotli - Decoder Out-of-Bounds Write | Brotli | 9.2 (v4.0) | Critical |
| CVE-2017-5254 | Cambium ePMP 1000 Account Password Reset | epmp 1000 firmware | 8.8 (v3.0) | High |
| CVE-2017-5255 | Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5) | epmp 1000 firmware | 8.8 (v3.0) | High |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-78 | CVE-2022-31814 , CVE-2017-5255 |
| CWE-252 | CVE-2026-111497 |
| CWE-269 | CVE-2017-5254 |
| CWE-284 | CVE-2017-5254 |
| CWE-787 | CVE-2026-111497 |
Documentation Source
- Original wiki page: WAF 340362
- Source revision: 3534
- Source revision date: 2013-06-15