OpenAI discloses Brotli flaw that can allow remote code execution

OpenAI says a red-teaming exercise uncovered a vulnerability in Brotli, a compression library bundled into software including Node.js, Bun, and Envoy. Malicious compressed data could allow an attacker to execute code on affected systems without an account.

The flaw, tracked as CVE-2026-111497, affects the decoder that turns compressed input back into usable data. Exposure depends on whether an application passes attacker-controlled data to a vulnerable decoder.

Both servers and clients can be exposed

The Node.js security advisory describes a buffer overflow that can corrupt process memory when an application decompresses malformed Brotli data through node:zlib. Possible consequences include crashes, memory disclosure, and remote code execution.

OpenAI describes risks on both sides of a connection: a server processing malicious compressed input, or a client decoding a malicious server's response.

The company says the underlying bug was corrected in Brotli's source code in February, before its security implications were recognized. That fix had not reached a newer release. OpenAI subsequently coordinated disclosure with Brotli and downstream projects.

Patched releases are available

OpenAI's mitigation guide lists Node.js 22.23.4, 24.22.1, and 26.12.1, and Bun 1.4.4, as fixed releases. It also lists updates for Envoy and Istio deployments configured for Brotli decompression.

Upstream Brotli released versions 1.0.10, 1.1.1, and 1.2.1 with the security fix.

Operators should update affected runtimes and bundled dependencies, then rebuild and redeploy software that embeds them. Where an immediate update is unavailable, OpenAI recommends temporarily disabling Brotli decoding of untrusted data.

Turning off outgoing Brotli compression alone does not address vulnerable paths that decompress incoming requests, fetched responses, or files.