OpenAI has disclosed a critical memory-safety vulnerability in the Brotli compression library that affects Node.js, Bun and Envoy Proxy. Publicly detailed by OpenAI on October 23, 2026, the flaw, tracked as CVE-2026-111497, could allow memory corruption and potentially remote code execution when vulnerable software decompresses specially crafted data.
The issue is particularly relevant to backend developers, cloud operators and hosting providers because Brotli is embedded in several widely used software platforms. Security patches are already available, but updating the correct component requires understanding where compressed data is decoded.
The vulnerability is an out-of-bounds write in the Brotli decoder. Affected applications that decompress attacker-controlled input may face crashes, memory disclosure or potential code execution. Patched versions are available for Node.js, Bun, Envoy and upstream Brotli.
OpenAI’s Brotli Discovery Reaches Multiple Server Platforms
OpenAI disclosed the finding during a broader discussion of its AI security red-teaming work. The vulnerability was reported to affected software maintainers, with Node.js crediting researchers from OpenAI Codex Security in its official release notes.
According to the Node.js security announcement, malformed Brotli-compressed input can cause the decoder to write beyond an internal buffer.
The underlying problem concerns an invalid block transition that is not handled as a permanent decoding error. Instead, the streaming decoder can continue processing data and corrupt memory outside an eight-byte internal buffer.
Depending on the affected software and execution context, the consequences may include application termination, disclosure of process memory or arbitrary code execution.
Importantly, this is a vulnerability in the shared Brotli implementation, not three unrelated defects independently discovered in Node.js, Bun and Envoy.
Brotli CVE-2026-111497: Patched Versions
The software projects have published separate updates incorporating the corrected decoder. Administrators should assess their actual runtime and proxy versions rather than assume a host operating-system update has fixed every deployment.
| Software | Fixed Releases | Exposure Context |
|---|---|---|
| Node.js | 22.23.4 24.22.1 26.12.1 |
Applications decoding malicious Brotli data |
| Bun | 1.4.4 | Bundled vulnerable Brotli decoder |
| Envoy Proxy |
1.40.0 1.39.3 1.38.6 1.37.8 1.36.12 |
Deployments with Brotli decompression configured |
| Brotli Library | 1.0.10 1.1.1 1.2.1 |
Applications embedding affected library releases |
The Envoy security advisory identifies Brotli decompression as the relevant configuration condition. Bun’s maintainers similarly confirm that version 1.4.4 replaces the vulnerable bundled decoder.
Why Brotli Decompression Matters More Than Compression Alone
Brotli is commonly used to reduce the size of data transferred between applications and clients. However, compressing an ordinary server response and decompressing data received from an untrusted source are different security operations.
The vulnerable path is reached when a decoder processes crafted input. For example, a backend that accepts compressed request bodies or a service that automatically decompresses responses from untrusted upstream systems may expose the affected decoding functionality.
An application that only produces Brotli-compressed responses is not necessarily exposed through that operation alone.
That distinction helps operators prioritize review of HTTP clients, API gateways, reverse proxies and application code using decompression APIs such as Node.js node:zlib.
Why the Fix Took Months to Reach Releases
The disclosure also highlights a software supply-chain problem. OpenAI said the underlying decoder issue had been corrected in Brotli’s source code in February 2026, but the security implications were not recognized at the time.
As a result, the correction had not reached a new upstream release before the coordinated October updates.
This illustrates why a repository containing corrected source code does not establish that the software installed in production contains the repair. Downstream projects must integrate the fix, publish releases and have those releases deployed.
What Server Administrators Should Check
Operators should prioritize vulnerable components that process untrusted compressed data.
- Inventory installed runtimes. Identify Node.js, Bun and Envoy versions across application servers, containers and deployment environments.
- Locate decoding paths. Check application and proxy configurations for Brotli decompression of external input.
- Deploy patched releases. Update affected software using the applicable vendor security releases.
- Rebuild bundled deployments. Refresh container images and executables containing embedded copies of vulnerable software.
- Verify remediation. Confirm the runtime or decoder version actually used after deployment.
Where an immediate update is not possible, disabling Brotli decoding for untrusted input may reduce exposure, provided the configuration actually prevents that input from reaching the vulnerable decoder. Changes to response-compression settings alone are not a reliable substitute for patching.
Servers.News recently covered emergency fixes for two critical PHP vulnerabilities . Although unrelated to Brotli, that incident also demonstrated the operational importance of replacing vulnerable server runtimes rather than relying solely on application-layer defenses.
What Remains Unknown?
The availability of a potential remote code execution path does not establish that every system using Brotli is remotely exploitable. Actual exposure depends on application behavior, component configuration and the attacker’s ability to provide compressed input.
The reviewed upstream advisories do not establish the number of vulnerable production deployments or a verified total of real-world compromises attributable to CVE-2026-111497.
For infrastructure teams, the immediate priority is therefore to locate affected decoders, verify whether untrusted data can reach them and deploy the relevant corrected versions.
Reporting basis: OpenAI’s October 23 security disclosure, Node.js security releases, the Bun advisory, and the Envoy advisory.
