OpenAI says red-team testing discovered a Brotli compression-library remote code execution vulnerability

Article

OpenAI: Discovered during red-team testing Brotli A remote code execution vulnerability exists in a compression library

PANews October 24 reports that OpenAI posted on X that it discovered during recent red-team exercises that a widely used compression library Brotli contains a vulnerability that allows remote code execution without authentication. Software including Node.js, Bun, and Envoy embeds this library. Attackers can compromise unpatched servers by sending malicious compressed data, or compromise clients that accept compressed data through malicious servers. OpenAI stated that the root cause of the issue was fixed earlier this year February in the Brotli source code, but it was not identified as a security vulnerability at the time; software embedding the library needs to be updated accordingly. According to The Hacker News, the vulnerability is designated CVE-2026-111497, and Node.js released a patched version on October 21.

Source: https://www.panewslab.com/zh/articles/01a16b12-0b34-7443-9dba-76b8aac8f1ea

Key points

PANews says that OpenAI stated it discovered during recent red-team exercises that Brotli contains a vulnerability.
The report says the vulnerability enables remote code execution without authentication.
Node.js, Bun, and Envoy were reported to be software that embed Brotli.
Attackers may attack unpatched servers by sending malicious compressed data, or attack clients that accept compressed data through malicious servers.
The report says that the issue in the Brotli source code was fixed earlier this year February, but was not identified as a security vulnerability at the time.
The report mentions that the vulnerability is designated CVE-2026-111497, and Node.js released a patched version on October 21.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Brotli is a compression library used by multiple software applications. The issue described in the report may allow attackers to execute code on target devices through malicious compressed data.

Why it matters to readers

If the relevant software is unpatched, servers or clients may be vulnerable to attacks involving malicious compressed data.

Systems using Node.js, Bun, or Envoy need to monitor dependency updates and verify the vulnerability.

Risks and unknowns

The supplied materials do not include OpenAI's original X post,Brotli the project's vulnerability description, or CVE an authoritative record.
The specific affected versions and the full scope of impact cannot be confirmed from the materials.
Whether Bun, Envoy, and other software embedding Brotli have released fixes cannot be confirmed from the materials.

OpenAI says red-team testing discovered a Brotli compression-library remote code execution vulnerability

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center