OpenAI red-team agents find a remote code execution bug in Brotli (CVE-2026-111497); Node.js 22, 24 and 26 are patched and developers should upgrade

Background and the problem

Brotli is Google's open-source compression format. Its decoder is built into HTTP br encoding, Node.js node:zlib, Bun, Envoy and much more. The trouble with libraries this deep is that a fix in source is not a fix in the field. OpenAI notes that the root cause was actually fixed in Brotli source in February 2026, but nobody realised it was a security bug and Brotli cut no new release, so every downstream project bundling Brotli kept the vulnerable code. It was found during red-teaming of OpenAI's frontier training environment, by agents powered by its most cyber-capable models.

How the bug works

According to the official Node.js security advisory, when the Brotli decoder hit an invalid block switch it reported a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer and wrote past its end. Anyone who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, memory disclosure or remote code execution, with no account needed. OpenAI stresses both directions: an unpatched server that accepts compressed input can be taken over by a malicious client, and an unpatched client that accepts compressed responses (such as curl --compressed) can be taken over by a malicious server.

Benchmarks and verified facts

This is not a model launch and there are no benchmarks. What can be verified: Brotli's official GitHub released v1.2.1, v1.1.1 and v1.0.10 on 2026-10-21, with release notes listing CVE-2026-111497 as an out-of-bounds write that permits remote code execution. The Node.js October security release rates it high, affecting 22.x, 24.x and 26.x, and credits Khai Tran and Sylvie Mayer of OpenAI Codex Security. OpenAI has not published how many vulnerabilities its agents found in total or which model they used.

What developers should do

Check runtimes first: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later, and move projects that depend on Brotli directly (C, Python and so on) to v1.2.1 (or 1.1.1 or 1.0.10). Then check software that bundles Brotli, such as Bun, Envoy, reverse proxies and container base images, and follow their security updates. Until patches land, OpenAI's Patch the Planet page (patchtheplanet.org/brotli) describes how to disable Brotli decoding temporarily, for example by rejecting br-encoded request bodies on servers and not advertising br on clients.