Patch Node.js, Bun and Envoy: OpenAI's red team found a Brotli RCEUnauthenticated remote code execution in the Brotli decoder (CVE-2026-111497). Fixed versions are out. Plus Codex cache behavior and a dots triage demo.OpenAISat 24 Oct 2026
IllustrationNewsConfirmedOpenAI's red team found a Brotli flaw: update Node.js, Bun and EnvoyA crafted Brotli stream can run an attacker's code in unpatched Node.js, Bun, Envoy and Istio, and fixed versions are out for all four.OpenAI
