OpenAI has disclosed a critical vulnerability it found during its own frontier red-teaming: CVE-2026-111497, a flaw in the Brotli data decoder that lets specially crafted compressed data corrupt memory and execute attacker code without any authentication. According to the advisory, the bug reaches some of the most widely used software on the internet — Node.js, Bun, and Envoy and Istio proxies configured for Brotli decompression — and the Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting it. OpenAI said in its announcement that fixes have already shipped across every affected project, so the current state of play is simple: administrators should patch immediately or switch off Brotli decompression of untrusted data until they can.
Brotli is one of the compression formats browsers and servers negotiate on nearly every web request, alongside gzip and zstd. Because it sits so deep in the network stack, a memory-corruption bug in the decoder does not stay theoretical for long — and this one arrives with the worst possible combination: no credentials required, remote triggerability, and code execution as the outcome.
How The Flaw Works
Brotli decoders take compressed bytes and reconstruct the original data in memory. The advisory says that malformed Brotli streams can corrupt the decoder’s memory, turning an ordinary decompression operation into a path to remote code execution. The attacker does not need a login, a token, or any prior access to the target — the only requirement is getting their crafted compressed data into a vulnerable decoder.
That entry point is easier to find than it sounds. Any application that passes attacker-controlled data to an affected Brotli decoder may be exposed, including compressed HTTP request bodies, responses fetched from remote servers, and compressed files opened locally. Proxies and API gateways that decompress traffic on behalf of backend services are an obvious target, because one poisoned request can land in infrastructure the attacker never touches directly.
Who Is Affected
The advisory names four high-profile targets: Node.js, the Bun JavaScript runtime, and the Envoy proxy and Istio service mesh — the latter two only where Brotli decompression is configured. Beyond the named projects, the exposure is broader: anything downstream of Google’s Brotli library that hands it untrusted input is potentially in scope.
OpenAI also warned that embedded runtimes deserve a check of their own. Electron applications, which bundle their own copy of the Chromium and Node.js stacks, may carry the vulnerable decoder independently of the system Node.js installation — so desktop apps are not automatically safe just because the server fleet has been patched. If in doubt, check the runtime’s Brotli dependency version directly.
Fixed Versions And What To Do Now
Coordinated fixes are already out, which is the good news. The patched releases are Node.js 22.23.4, 24.22.1 and 26.12.1; Bun 1.4.4; Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8; Istio 1.29.9, 1.30.6 and 1.31.2; and Google Brotli upstream 1.0.10, 1.1.1 and 1.2.1. Operators should upgrade to the fixed release matching their deployment line and confirm the decoder version bundled in any custom or embedded builds.
Where an immediate upgrade is not possible, the advisory’s interim mitigation is to disable Brotli decompression of untrusted data until the patch can be applied. That trade-off — slightly larger payloads in exchange for closing an unauthenticated code-execution path — is one administrators have had to make before during mass-exploitation waves like the PHP2Shell episode, where the gap between disclosure and patching became the real attack surface.
Why It Matters
Brotli is not a niche format — it is negotiated on a large share of web traffic and embedded in the JavaScript runtimes and service meshes that power modern backends. A single unauthenticated remote-code-execution flaw in its decoder therefore has a blast radius far larger than the CVE number suggests, touching servers, proxies, and desktop apps at once. Disclosure timing matters too: with fixes published and the vulnerability now public, scanners will be probing for unpatched endpoints within days, and the organizations that patch first will be the ones that never have to find out whether they were exposed.
The disclosure also marks a notable moment in how frontier AI labs handle offensive security research. Rather than sitting on a zero-day found in its own infrastructure testing, OpenAI coordinated disclosure, credited the finders, and pushed fixes upstream — the response every red-teaming program claims to aspire to, now demonstrated on infrastructure the whole industry shares.
Background
The finding came out of OpenAI’s frontier-security red-teaming, in which agent-based testing probes for zero-day vulnerabilities as part of the company’s “Securing our frontier model training environment” push — the announcement went out on the official @OpenAI account on X, linking the full advisory at patchtheplanet.org/brotli. It lands at a time when OpenAI’s security posture is under unusual scrutiny, from the METR Redwood audit of its models to the misalignment incidents logged on government sites, making this public disclosure of a real zero-day — found, reported, and fixed — a counterpoint worth noting.
0 Comments