OpenAI discloses unauthenticated RCE flaw in Brotli

• Crafted Brotli data can trigger unauthenticated remote code execution in software that decompresses it, including clients receiving malicious responses, according to OpenAI's disclosure.
• The root cause was fixed in February without its security impact being recognized; OpenAI says no newer Brotli release followed until the coordinated security response.
• Exposure extends beyond Node.js: cramforce flagged Python's optional Brotli package, while Vercel's notice identified affected Node.js 22, 24, and 26 runtimes.

An eight-byte buffer kept accepting input after a malformed block switch, the Node.js advisory explains. Electron applications can contain multiple Brotli copies, and fixing their Chromium component does not establish that their embedded Node.js runtime is fixed, according to the patch guide linked by OpenAI.

OpenAI found CVE-2026-111497 during a red-teaming exercise. The company says the underlying bug had already been corrected in Brotli's source in February, but nobody had recognized the security implications and no newer release had shipped.

That is a nasty release gap: vulnerable packaged code survived for months after the source-level correction. Brotli published its 1.2.1 security release on October 21; Node.js issued patched releases the same day.

The Node.js project credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting the vulnerability. OpenAI says it coordinated disclosure with Brotli and downstream projects, some of which were still releasing updates when it announced the finding.

Node.js describes the failure as an error-handling bug in its bundled Brotli decoder. Its technical advisory gives this sequence:

1. An invalid block switch was reported as a temporary need for more input rather than a permanent format error.
2. The streaming decoder continued appending input bytes to an eight-byte internal buffer.
3. Malformed input could write beyond that buffer and corrupt process memory.

Applications passing attacker-controlled Brotli data to node:zlib can consequently suffer crashes, process-memory disclosure, or remote code execution. The Node.js project rates the issue high severity.

Both sides of an HTTP exchange can be targets. A malicious client can attack a server that decompresses its input; a malicious server can attack a client that decompresses its response, including the curl --compressed example in OpenAI's explanation.

The disclosure's patch guide identifies these decoding paths:

• Incoming requests: compressed bodies decoded by proxies, middleware, or application code.
• Fetched responses: Brotli content returned by an untrusted server to an HTTP client or background worker.
• Files: untrusted compressed files, including processing paths such as font decoders.

Exposure depends on attacker-controlled bytes reaching an affected Google Brotli decoder. Using Brotli only to compress outgoing data does not by itself establish exposure to this decoder flaw.

Python exposure comes through the brotli package rather than the interpreter alone, a distinction highlighted by cramforce. Its native binding compiles the same vulnerable C decoder, according to the Python vulnerability entry, which identifies version 1.2.1 as fixed.

As of October 23, the patch guide linked by OpenAI lists these fixed releases:

| Component | Fixed releases |
| --- | --- |
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.4 |
| Envoy Proxy | 1.40.0, 1.39.3, 1.38.6, 1.37.8 |
| Istio | 1.29.9, 1.30.6, 1.31.2 |
| Google Brotli | 1.0.10, 1.1.1, 1.2.1 |

The guide also lists Envoy 1.36.12 as containing the fix, but marks that branch unsupported; Istio 1.29 is likewise end of life. Vercel's advisory says Node.js 20 is end of life and will not receive this fix.

Bundled wheels, static binaries, container images, and embedded runtimes can carry their own decoder copies. The guide's deployment procedure includes rebuilding affected artifacts and restarting or redeploying running services, workers, scheduled jobs, and replicas.

Vercel announced firewall mitigations for every deployment before the official runtime patch was available, alongside a rollout of managed runtime upgrades.

Self-hosted Node.js behind Vercel also receives its WAF filtering, cramforce said. Vercel's security advisory specifies that the rules work regardless of the backend runtime, but cover only traffic passing through Vercel's network, not responses that functions fetch from other servers.

Next.js image optimization is one such server-side fetching path: Vercel says it does not block Brotli responses. The patch guide describes disabling built-in image optimization as a temporary mitigation, without covering other fetches or custom image loaders.

HTTP negotiation has another limit: removing br from Accept-Encoding does not prevent a malicious server from sending Brotli anyway. The same guide's client-side mitigation rejects unsupported response encodings before decompression; a header check after an automatically decoded body arrives can be too late.