A memory-handling flaw in the Brotli decoder lets attackers run code remotely without any authentication. On October 23, 2026, OpenAI disclosed that its Codex Security team had dug up the vulnerability during a red-team exercise; back on October 21, the Node.js project had already shipped security updates — versions 26.12.1, 24.22.1 and 22.23.4, covering the 26.x, 24.x and 22.x release lines.
Where the bug lives: a botched "block switch"
The Node.js security advisory describes the root cause in detail. When fed malformed compressed input, the decoder mistook an invalid block switch for a temporary need for more input, rather than a permanent format error. So the streaming decoder kept appending bytes into an eight-byte internal buffer, writing right past its boundary.
An attacker able to hand an application Brotli-compressed data thereby gains the ability to corrupt process memory: a crash at best, memory disclosure at worst, and remote code execution in the worst case. The attack works both ways — servers that accept compressed input can be taken over, and client tools with compression enabled (like curl) are exposed when they talk to a malicious server.
From Node.js to Envoy: a wider blast radius than it looks
Brotli, developed by Google, has become part of the air of internet infrastructure: Node.js, Bun and Envoy all embed the decoder. An application may never touch compression code directly and still carry a vulnerable decoder in its dependency tree — the kind of "invisible dependency" that makes supply-chain vulnerabilities so stubborn.
A vulnerability that walked around unpatched for eight months
The most telling detail is its backstory: the root cause had already been fixed in Brotli's upstream source back in February 2026, but nobody recognized it as a security issue at the time. No CVE was assigned, and no downstream updates were pushed. For eight months, a genuinely exploitable high-severity flaw sat exposed in the open-source supply chain — not because nobody could fix it, but because nobody recognized it as worth fixing. Only after OpenAI's agentic red team surfaced it did Brotli get CVE-2026-111497 and ship new releases. Node.js rates the highest severity in this batch as high, and notes that all mainstream non-EOL release lines are affected.
What to do: upgrade first, then audit your dependencies
Teams on Node.js should move to the fixed release for their line (26.12.1 / 24.22.1 / 22.23.4); users of Bun and Envoy should wait for the downstream security updates to land everywhere. It's worth auditing the dependency tree for anything that bundles a Brotli decoder — a patch only half-applied is a door only half-closed.
This is also another data point for "AI-assisted vulnerability hunting": less than a month ago, AI helped dig out a remote-execution entry point hiding in PHP's core for over a decade (related coverage); OpenAI itself isolated its frontier-model training environment from the internet after red-teaming. AI is moving from "auxiliary scanner" to a lead actor that can genuinely surface zero-days — initiatives like Patch the Planet, which hunts vulnerabilities in open-source software, are only going to get busier.
