Attackers could take control of computers running unpatched versions of Brotli, a widely used compression library, without logging in or creating an account, OpenAI said.
OpenAI found the bug while red-teaming. Brotli ships inside Node.js, Bun and Envoy, among other software, and updates are out now. The flaw is tracked as CVE-2026-111497.
The danger runs both ways. A server that takes in compressed data could be hijacked by a client that sends a booby-trapped file, OpenAI said. A malicious server could likewise take over a client that accepts compressed replies, such as curl when it runs with the –compressed option.
Patch the Planet, a site that calls itself an OpenAI Daybreak initiative, says the bug can also crash programs or expose memory. Software is at risk whenever it hands untrusted data to a vulnerable Brotli decoder. That includes compressed web requests, downloads from servers it doesn’t trust and compressed files.
Fixes released
As of Oct. 23, the site listed Node.js 22.23.4, 24.22.1 and 26.12.1 as fixed. Bun users need version 1.4.4, which includes Brotli 1.2.1.
For Envoy Proxy, the fix is in 1.40.0, 1.39.3, 1.38.6 and 1.37.8. Version 1.36.12 is patched too, but that branch no longer gets support. Istio has fixed releases in 1.29.9, 1.30.6 and 1.31.2, though the 1.29 line is at end of life.
Google’s own Brotli library was updated to 1.0.10, 1.1.1 and 1.2.1.
The underlying bug was actually repaired in Brotli’s code in February, OpenAI said. Nobody realized then that it was a security risk, and Brotli hadn’t put out a new release since. Every program that bundles the library now has to pick up the fix, and then its users have to install it.
OpenAI said it told Brotli’s maintainers and downstream projects, including Node.js, about the problem. Some have shipped updates and others are still working on them. Brotli put out new versions and published the CVE.
If patching must wait
Until updates are in, Patch the Planet recommends turning off Brotli decoding for untrusted data. Gzip and deflate can stay on.
On servers, that means rejecting requests labeled Content-Encoding: br before a proxy, middleware or body parser unpacks them. On the client side, automatic Brotli decompression should be shut off. Dropping br from the Accept-Encoding header won’t do it, the site warns, because a server can send Brotli anyway.
Envoy Proxy and Istio users should disable the Brotli decompressor filter for requests and responses alike. Doing so can let compressed data pass through untouched, so any decoder further down the line needs protection as well. Next.js users are told to switch off built-in image optimization until Node.js is patched.
Disabling Brotli compression on a CDN or web server doesn’t stop decompression elsewhere. Size limits on requests and web application firewall rules won’t close every gap either, the guidance says.
After patching, administrators should rebuild any containers or programs that embed an affected runtime. Every service, worker, scheduled job and replica still on the old build needs a restart, and the running version should be checked against the vendor’s fixed release.
Have something to promote?
Bring your business, services or event to our readers.
