OpenAI Finds Critical Brotli Flaw That Could Let Attackers Take Over Systems With No Login Needed
OpenAI Says It Found the Flaw in a Red Team Exercise
OpenAI says it found a critical flaw in Brotli, a widely used compression library built into software like Node.js, Bun and Envoy.
An attacker could take over an unpatched system just by sending it malicious compressed data, with no login needed.
OpenAI said the discovery came during a recent red team exercise. Reporting on the disclosure, including from The Hacker News via other outlets, said the company disclosed the issue to affected projects so patches could be prepared.
What the Vulnerability Is
The flaw is tracked as CVE-2026-111497 and has been nicknamed Node2Shell.
It is an out-of-bounds write in the Brotli decoder. According to the CVE record described in security coverage, the issue sits in the decoder file c/dec/decode.c and can be triggered by a crafted Brotli stream.
That kind of bug can corrupt memory next to the decoder state. The possible impact described in the record includes a crash, a memory leak, or, in some cases, remote code execution.
The flaw was rated high severity with a CVSS score of 9.2, according to security coverage of the disclosure. The attack requires no privileges and no user action, and it can be carried out over a network.
The Node.js advisory credits OpenAI Codex Security, with Khai Tran and Sylvie Mayer, for reporting the flaw.
Both Servers and Clients Are Exposed
OpenAI said attackers could take over unpatched servers by sending malicious compressed data.
It also said clients that accept compressed data could be compromised through a malicious server. That means the risk is not limited to incoming requests.
Security coverage noted exposure is highest for applications that decompress untrusted Brotli data directly, use fetch() to pull outside data, or use Express 5 with body-parser, which can automatically decode compressed request bodies.
Not every Node.js application is equally exposed. An application has to decompress Brotli data supplied by an outsider for the most direct attack path to apply, though maintainers still advise updating.
A Fix That Existed Months Before It Was Called a Security Bug
OpenAI said the root cause was fixed in the Brotli source code in February of this year, but it was not recognized as a security vulnerability at the time.
That gap is central to the risk. Many projects bundle their own copy of Brotli instead of using a shared system copy, so an upstream fix does not reach users until each downstream project pulls it in and ships a release.
The Patches to Watch
Node.js released patched versions on October 21. The fixed lines are 22.23.4 for 22.x, 24.22.1 for 24.x, and 26.12.1 for 26.x, according to Node.js release coverage.
The issue affects Node.js 26.x, 24.x and 22.x. Older end-of-life lines such as 20.x will not receive the fix and need to be migrated, according to the same coverage.
For Bun, versions before 1.4.4 were affected, and users were told to upgrade to 1.4.4 or newer, according to Aikido's advisory summary. For the standalone Brotli library, the corrected versions listed were 1.2.1, 1.1.1 and 1.0.10.
The Node.js release was broader than one bug. The same security update addressed nine additional vulnerabilities, including TLS hostname-check issues, according to security coverage.
As of October 23, security coverage said there was no public evidence of widespread exploitation, though proof-of-concept work had emerged. That combination usually keeps urgency high for operators who have not patched.
How This Could Affect Markets
A flaw in a library this widely bundled puts attention on cloud exposure, incident response spending, and how fast large platforms can force updates across hosted customers.
Cybersecurity names often see increased options activity on major vulnerability disclosures, as traders position around expected demand for detection, firewall and endpoint tools.
Stocks to watch include CRWD, PANW and ZS for security spending, and NET for edge and web application protection.
Platform exposure also matters. Watch GOOGL, as Brotli originated as a Google compression format and Google acts as the CVE numbering authority in the record described above, plus MSFT and AMZN for cloud and developer platform risk and patching costs.
Traders will be watching for any disclosure of exploitation, emergency customer communications from hosted Node.js platforms, or a wave of additional downstream patches from projects beyond Node.js, Bun and Envoy.
Bottom Line
This is a patch-now vulnerability, not a theoretical one, because it is unauthenticated, network-reachable and sits in code that handles outside data by design.
The next signal will be whether exploitation reports emerge before most operators have moved to the October 21 patched releases.