OpenAI’s Brotli Bug Reaches Past Node: Bun, Python and Envoy Need Fixes

One decoder, many copies. Each program that ships Brotli has to take the fix on its own.

OpenAI says that while its agent teams red-teamed the environments it trains frontier models in, they also found a vulnerability in Brotli, a compression library built into Node.js, Bun, Envoy and much else. It allows unauthenticated remote code execution, OpenAI writes. An unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input could be taken over by a malicious server.

The flaw, CVE-2026-111497, is an out-of-bounds write in Google’s C decoder. The OSV entry for Python’s Brotli package describes a crafted stream that makes the decoder carry on with corrupted state and write past its buffer. Node.js shipped its fix on Oct. 21 and credits Khai Tran and Sylvie Mayer of OpenAI’s Codex Security. Other projects have followed one by one since.

Python is the quiet case. With Brotli or brotlicffi installed, requests, urllib3, httpx and aiohttp decode Brotli responses on their own, so an app can be exposed without importing Brotli itself, The Hacker News explains. Dependency scanners may miss it: the CVE record names Google’s repository, and the Python advisories were only added on Oct. 23.

Imperva’s red team ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64, as a fetched response and as an Express request body. The exploit took several tries and has not been released. No attacks in the wild are reported: CISA’s Oct. 23 assessment records exploitation as “none.” Google rates the flaw 9.2 on CVSS 4.0; Red Hat rates it 8.1.

The fix has an odd history. OpenAI says the root cause was fixed in Brotli’s source code in February, but nobody knew then that it was a security flaw, and no newer release of Brotli existed. Reuters reports OpenAI found it during the same exercise that let it resume frontier training on Oct. 1.

What to do: update to a fixed version, then restart services and rebuild container images, since a running process keeps the old decoder. Where you cannot update yet, OpenAI and the security firm Aikido advise rejecting requests with Content-Encoding: br and turning off automatic Brotli decoding in HTTP clients, The Hacker News reports. @levelsio’s reaction: “Okay now it’s Brotli’s turn.”