OpenAI's red team found a Brotli flaw: update Node.js, Bun and Envoy
A crafted Brotli stream can run an attacker's code in unpatched Node.js, Bun, Envoy and Istio, and fixed versions are out for all four.
If you run Node.js, Bun, Envoy or Istio, check your versions today: a crafted Brotli stream can run an attacker's code on unpatched builds, and fixes are out. @OpenAI posted at 6:55 PM ET Friday that during the red-teaming exercise "we also found a vulnerability that allows for unauthenticated remote code execution in Brotli".
What changed#
Same exercise as OpenAI's training containment post. The flaw is CVE-2026-111497. The CVE record covers Google Brotli "versions 1.0.3 through 1.2.0" and credits "OpenAI Codex Security - Khai Tran and Sylvie Mayer". Brotli released 1.0.10, 1.1.1 and 1.2.1 on Oct 21; Node.js shipped 22.x, 24.x and 26.x fixes the same day. OpenAI's post says the root cause was fixed in Brotli in February, "but it wasn’t known at the time that it gave rise to a security vulnerability".
The ratings differ. Node.js labels it "(high)"; the CVE record scores it 9.2, "CRITICAL", on CVSS 4.0.
Why it matters#
Our read: it cuts both ways. OpenAI's post says an unpatched server "could be taken over by a malicious client," and an unpatched client "could be taken over by a malicious server." Imperva ran code through fetch() and Express 5 on Node.js 24.22.0; "The same inputs were rejected by 24.22.1."
How to fix it#
Per the patch page OpenAI linked:
- Update to a fixed release (versions in the steps above).
- Rebuild images that embed the runtime, then restart every old service, worker, job and replica.
- Can't patch yet? "disable Brotli decompression of untrusted data until the update is deployed."
Audit prompt (ours, untested):
Read-only audit. List every Node.js and Bun version this repo pins; mark each fixed or not against 22.23.4, 24.22.1, 26.12.1 or Bun 1.4.4. List every decompress path. Do not change anything.
Good to know#
- Node.js 20 gets no fix. Vercel says it "reached end of life and will not receive this fix."
- Trimming
Accept-Encodingisn't enough; the patch page says it "does not stop a server from sending it." - Electron apps carry their own Node.js: "a fixed browser component does not establish that the embedded Node.js runtime is fixed," per the patch page.
Last checked: Oct 24, 2026, 5:56 to 6:20 AM ET (sources above). What changed: first published Oct 24; no updates since.
Steps
- Update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, Envoy to 1.40.0, 1.39.3, 1.38.6 or 1.37.8, and Istio to 1.29.9, 1.30.6 or 1.31.2, per the patch page OpenAI linked.
- Update Google Brotli itself to 1.0.10, 1.1.1 or 1.2.1 wherever you build against it, per the CVE record.
- Rebuild containers and executables that embed the affected runtime, then restart or redeploy every service, worker, scheduled job and replica on the old build, per the patch page.
- If you can't patch yet, reject requests with Content-Encoding: br before any proxy, middleware or body parser decodes them, per the patch page.
- Turn off automatic Brotli decompression in HTTP clients that fetch from servers you don't control until they are patched, per the patch page.
Read-only audit. List every Node.js and Bun version this repo pins (Dockerfiles, .nvmrc, .node-version, package.json engines, CI workflows, Vercel or other deploy settings). Mark each one fixed or not against Node.js 22.23.4, 24.22.1 or 26.12.1 and Bun 1.4.4. Then list every place the code decompresses data it receives or fetches: body parsers, fetch calls, zlib calls, proxies. Do not change anything.
