OpenAI Finds Brotli Flaw That Can Lead to Remote Code Execution
A compression library buried under Node.js and Bun is the kind of layer people forget to patch, so the fix matters less than how many downstream runtimes ship it before their users do.
Reporting from 1 source: GIGAZINE.
OpenAI found CVE-2026-111497 in Google's Brotli compression tool. Some data compressed with Brotli can corrupt memory and allow remote code execution, putting applications built on Node.js and Bun at risk. The flaw was found during the red team exercises OpenAI runs to harden its research environment after a July 2026 incident. Google has shipped patches, and Node.js, Bun, Envoy Proxy, and Istio have released fixed versions.
The flaw is tracked as CVE-2026-111497 and carries the nicknames Node2Shell and HTTP2Shell. OpenAI published the details through Patch the Planet, its framework for using AI to harden open source projects, after finding the bug in its own red team exercises. Google has shipped Brotli v1.2.1, v1.1.1, and v1.0.10. The runtimes that embed Brotli, Node.js and Bun among them, have their own patched releases, and OpenAI is asking for updates to be applied quickly.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google