OpenAI discloses Brotli decoder flaw CVE-2026-111497 in Node.js, Bun, Python and Envoy

OpenAI’s Codex Security team reported a memory-corruption flaw in Google’s Brotli decoder, tracked as CVE-2026-111497, on Oct. 21, 2026, and calls it unauthenticated remote code execution in Node.js, Bun and Envoy. 0ed4268a

The flaw sits in c/dec/decode.c, the C code that unpacks a Brotli stream, in Google Brotli versions 1.0.3 through 1.2.0. NVD’s technical analysis says the cause is a buffer overflow in c/dec/decode.c; Google reported improper validation of return values (CWE-252) and out-of-bounds writing (CWE-787); the decoder writes data beyond the pre-allocated buffer, contaminating adjacent decoder state memory. The analysis lists memory theft, denial of service and arbitrary code execution as possible outcomes. Google, which assigned the CVE, rates it 9.2 critical on CVSS 4.0 (Common Vulnerability Scoring System); Node.js rates it high and Red Hat rates it 8.1 important.

Every supported Node.js release line — 22.x, 24.x and 26.x — contained the flaw before the Oct. 21, 2026 update, Node.js said. Anyone running Node.js or Bun faces risk if the app decompresses attacker-controlled Brotli data, including direct use of node:zlib and fetch(), which automatically decompresses Brotli responses. A plain Node.js HTTP server does not decode request bodies on its own, but Express 5 and body-parser 2 unpack Brotli uploads, and fetch() reaches the decoder when it reads a Content-Encoding: br response.

Bun version 1.4.4 or newer removes the flaw, and Google shipped the same fix in Brotli 1.2.1, 1.1.1 and 1.0.10. In Python, risk comes from having the Brotli or brotlicffi package installed at all, because HTTP clients such as requests, urllib3, httpx and aiohttp decode Brotli responses on their own. That exposes applications that never import Brotli directly. A lilting.ch comparison of v24.22.0 and v24.22.1 found fetch() reaches the decoder when a server returns Content-Encoding: br even if the client sends Accept-Encoding: identity.

Envoy and Istio are exposed only when Brotli decompression is enabled through an Envoy filter; with it off, the flaw cannot be reached. Debian fixed its brotli package for Debian 13 (trixie) on Oct. 23, 2026, in version 1.1.0-2+deb13u1, while Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending a fix as of Oct. 22, 2026.

Decoding Brotli data that someone else controls exposes a program; merely having Brotli present does not create a remote path. OpenAI describes the threat as bidirectional: a malicious client can take over an unpatched server that accepts compressed input, and clients that accept compressed responses are also at risk. Dropping br from Accept-Encoding does not help alone, because a server can send Brotli whatever the client requests.

Imperva’s Red Team, calling its work Node2Shell, ran attacker-supplied code on unmodified Node.js 24.22.0 for Linux on ARM64, delivering the exploit as a fetched response and an Express request body after repeated tries. Researchers demonstrated process memory disclosure and command execution in unpatched Node.js 22.x, 24.x and 26.x versions. A first public proof of concept arrived Oct. 22, 2026, and reached code execution only against a deliberately unfinished target.

CISA’s Oct. 23, 2026 assessment found no observed exploitation and no automation. Red Hat said no reliable public proof-of-concept exists for code execution. No real-world attacks or in-the-wild exploitation have been reported.

Node.js released v22.23.4, v24.22.1 and v26.12.1 on Oct. 21, 2026, fixing 10 vulnerabilities; no fixes come for end-of-life v18, v20, v23 and v25. Of the 10 fixed issues, Node.js rates four High, three Medium and three Low. Users of end-of-life lines must migrate rather than patch.

The fixing change appeared in Brotli source on Feb. 27, 2026, but no new Brotli release carried it until Oct. 21, 2026. Node.js closed the gap by cherry-picking Brotli commit 0ed4268a from February, so the decoder stops before writing past the buffer.

Installing the patch is not enough since the old decoder stays loaded in a running process until restart, so the service must restart and any container image must be rebuilt after updating. Node.js has no published workaround, so updating the runtime is the only fix. OpenAI’s disclosure page and Aikido recommend rejecting Content-Encoding: br requests before decoding, disabling Brotli decoding in clients, and uninstalling Brotli and brotlicffi in Python.

Advisory entries PYSEC-2026-4322 and PYSEC-2026-4323 were added Oct. 23, 2026, but dependency scanners may not flag the Python packages yet, so check installed versions manually. The CVE record names Google’s Brotli repository rather than the PyPI packages, and GitHub’s advisory lists no affected package, which Dependabot reads.

Vercel added emergency firewall rules on Oct. 21, 2026, but said they do not cover responses that serverless functions fetch from other servers; only updating the runtime or library closes that path. Downstream projects including Trigger.dev, webmail servers and developer tooling qlty pushed patches to pull in the fixed Node.js runtime.

The advisory page is part of Patch the Planet, a Daybreak initiative OpenAI runs with Trail of Bits, and patchtheplanet.org consolidates affected software, fixed releases and how to temporarily turn off Brotli decoding. OpenAI pairs Trail of Bits engineers with HackerOne and Calif for disclosure and triage, validating reports before they reach maintainers and helping test patches.

Node.js credits Khai Tran and Sylvie Mayer of OpenAI’s Codex Security for reporting the flaw, and maintainers Matteo Collina and Antoine du Hamel for the fix. Fixed releases are available for Node.js 22.x, 24.x and 26.x, Bun 1.4.4 and newer, and Brotli 1.2.1, 1.1.1 and 1.0.10, while Amazon Linux 2023 and end-of-life Node.js lines still lack patches.