OpenAI's Codex Security team found a memory-corruption flaw in Google's Brotli decompression library that can let crafted compressed data write past the end of a buffer, opening the door to remote code execution. The bug, tracked as CVE-2026-111497, reaches well beyond one project: Brotli is embedded in Node.js, Bun, Envoy, Istio and popular Python packages, and fixes are now landing across all of them.
Google, which assigned the CVE, scored it 9.2, or critical, under CVSS 4.0. Red Hat rated it 8.1, important, and the Node.js project labeled it high without publishing a score. Depending on the input, the flaw can cause a crash, a memory leak, or attacker-controlled code execution.
OpenAI said the bug cuts both ways, warning that "an unpatched server that accepts compressed input could be taken over by a malicious client." Node.js credited Khai Tran and Sylvie Mayer of Codex Security with the report, and maintainers Matteo Collina and Antoine du Hamel with the fix. OpenAI posted about the find on X on October 23 and published guidance through Patch the Planet, its open-source security initiative.
Key facts
- 01OpenAI's Codex Security team reported CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder.
- 02Google rated the flaw 9.2 (critical) under CVSS 4.0; Red Hat scored it 8.1 and Node.js labeled it high.
- 03Node.js shipped fixes on October 21 in versions 22.23.4, 24.22.1 and 26.12.1; Bun is fixed in 1.4.4.
- 04Brotli versions 1.0.3 through 1.2.0 are affected, with fixes in 1.0.10, 1.1.1 and 1.2.1.
- 05No in-the-wild exploitation has been reported, and CISA's assessment recorded exploitation as none.
The root cause had technically been fixed already. A change committed to Brotli's source code on February 27 closed the hole, but no release carried it and its security impact went unrecognized until the October 21 disclosure, when Node.js and Google shipped patches and other vendors followed.
In Node.js, exposure comes from calling fetch() on a response encoded with br, or from Express and body-parser handling br request bodies. The fixed releases are 22.23.4, 24.22.1 and 26.12.1, part of an October 21 update that addressed 10 flaws in total. Node.js 20.x and older lines are end-of-life and receive no fix.
Bun is patched in 1.4.4. The underlying Brotli C library is affected from 1.0.3 through 1.2.0 and fixed in 1.0.10, 1.1.1 and 1.2.1. Envoy, Istio, cdxgen, and the Python Brotli and brotlicffi packages also have fixed versions, and Debian shipped a patched brotli package for Debian 13 on October 23.
Imperva's Red Team, which calls its work Node2Shell, demonstrated code execution on an unmodified Node.js 24.22.0 build for Linux on ARM64. That exploit has not been released, took several attempts, and was tested only on that one build. Red Hat said there is no reliable public proof-of-concept for running code.
No in-the-wild exploitation has been reported. CISA's assessment on October 23 recorded exploitation as none and automation as no.
For teams that cannot patch immediately, the published mitigations are to reject requests with Content-Encoding set to br before decoding, disable automatic Brotli decoding in HTTP clients, or uninstall the Python Brotli packages. Removing br from Accept-Encoding does not help, since servers can still send Brotli. Node.js has no published workaround, so updating is the only fix there, followed by restarting services and rebuilding container images.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
