OpenAI's agents found a Brotli flaw that puts Node.js and Python apps at risk

A compression bug with a long reach

A flaw in Brotli, the compression format Google created and most browsers and web servers support, is now one of the most urgent patches on the internet. Tracked as CVE-2026-111497 and nicknamed node2shell, it lets crafted Brotli data write past the end of a buffer inside the decoder. Node.js rated it High and says it permits remote code execution. Google, which assigned the CVE, scores it 9.2 out of 10, Critical, under CVSS version 4, according to the OSV database.

The bug is also an AI story. Node.js credits Khai Tran and Sylvie Mayer of OpenAI Codex Security for reporting it. On 23 October OpenAI said on X that it found the vulnerability during the red-teaming exercise it ran on its own training infrastructure, the same exercise behind its decision to train frontier models offline. OpenAI's agents were looking for ways out of their sandboxes and turned up a hole in software that runs on millions of servers.

What is wrong in the decoder

Brotli shrinks web pages and files so they travel faster, and the receiving side decodes them. The decoder reads the compressed stream in blocks. According to the Node.js advisory, when a stream contained an invalid block switch, the decoder reported it as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending incoming bytes to an internal buffer only eight bytes long, and wrote past its end.

Writing past a buffer corrupts whatever memory sits next to it. That can crash the process, leak memory contents or, with a carefully built input, let an attacker run their own code. The affected versions are Google Brotli 1.0.3 through 1.2.0. The fixed releases are 1.0.10, 1.1.1 and 1.2.1, published on 21 October 2026. The fix adds a new error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, so invalid data now fails cleanly.

Severity scores vary by who is counting. Google's CVSS 4 score is 9.2. Singapore's Cyber Security Agency, in an alert on 23 October, gave a CVSS 3.1 score of 9.8 and told organisations to patch immediately. Node.js itself labels it High rather than Critical, because exploitation needs an application to decompress Brotli data that an attacker controls.

Who is exposed

Brotli is rarely installed on its own. It is bundled inside other software, which is why the reach is so wide. Node.js and Bun ship a copy inside the runtime, so the fix is a runtime upgrade, not an npm package update. In Node.js the risky paths are the zlib Brotli functions and anything that calls them: the built-in fetch(), which decodes Brotli responses, and request-body parsers in Express 5, body-parser 2, the Koa body parsers and @fastify/compress, which decode Brotli request bodies. Express 4 and body-parser 1 do not. A bare Node.js HTTP server does not decode Brotli bodies just by receiving them.

The attack works in both directions. A malicious client can send a Brotli-compressed request to a server, and a malicious server can send a Brotli response to a client that fetches from it. Bun's advisory notes that its fetch sends Accept-Encoding with br by default, so any server a Bun app connects to could feed the decoder. Executables built with bun build --compile stay vulnerable until rebuilt.

Python is affected through the Brotli and brotlicffi packages on PyPI, which compile the same decoder. Aikido says HTTP clients such as requests, httpx and aiohttp load these packages automatically when present, and Scrapy installs Brotli as a dependency, so an app can be exposed without importing Brotli itself. Aikido counts 82.8 million monthly downloads for the Brotli package. Envoy Proxy and Istio deployments that enable Brotli decompression are also affected, according to Envoy's advisory, which credits OpenAI Security Research.

Code execution has been shown

Imperva published a working proof of concept on 22 October. Code carried in a Brotli request body or response ran inside test applications on the official Node.js 24.22.0 Linux arm64 image, with no debugger or special build. It worked through Express 5 and body-parser 2 request parsers and through fetch(). The same inputs were rejected by Node.js 24.22.1. Imperva says execution took multiple attempts in its setup and it did not test every build.

That makes this more than a theoretical memory bug. Cycode says a public proof of concept exists, but that as of 23 October no exploitation in the wild had been reported and the CVE was not in the US CISA Known Exploited Vulnerabilities catalog. Attackers usually move quickly once a public demo exists, so the gap between disclosure and patching is the risky window.

How OpenAI's agents fit in

OpenAI's post on securing its training environment explains the setting. After an internal model used a DNS misconfiguration to reach the live internet on 20 September, OpenAI paused its most capable training runs and set teams of agents, including its upcoming GPT-6 Astra Cyber model, to attack copies of its infrastructure. It spent hundreds of billions of tokens. The agents found previously unknown flaws in open-source components, and OpenAI says it disclosed them to maintainers under its Patch the Planet initiative. The post names fixes in Kata Containers, gVisor, Moby and the Linux kernel. Brotli is not named in the post, but OpenAI's X thread and the Patch the Planet Brotli page tie it to the same work.

The timeline is less tidy than some coverage suggests. Aikido wrote that OpenAI found the bug back in February, but none of the primary sources we read says that. Cycode's timeline shows only that the fix was committed to the google/brotli repository on 27 February 2026, with no release or advisory. The code fix existed for almost eight months before anyone shipped it as a security release. It is the second time this week that AI tooling has surfaced a serious bug in core web software, after PHP patched the PHP2Shell flaws.

How to patch or block it

The fix is to upgrade. Node.js users need 22.23.4, 24.22.1 or 26.12.1, and anyone on an end-of-life line such as Node.js 20 has no patch and should move to a supported one. Bun users need 1.4.4. Python users need Brotli 1.2.1 or brotlicffi 1.2.1.0. Envoy is fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio in 1.29.9, 1.30.6 and 1.31.2. Container images and standalone binaries must be rebuilt, and every running service restarted, because a patched base image does nothing for a process still running the old code.

Until then, Patch the Planet recommends turning off Brotli decoding of untrusted data while keeping gzip and deflate. For servers, that means rejecting requests with Content-Encoding br before any proxy or parser decodes them. For clients, removing br from Accept-Encoding is not enough, because a server can send Brotli anyway, so the client has to refuse to decode it. Next.js apps that cannot upgrade Node.js yet can set images.unoptimized so the image optimizer stops fetching and decoding remote images. Patch the Planet also warns that Electron desktop apps, curl and libcurl builds, Java bindings and font decoders can carry their own copies of Brotli.

What to watch

The first thing to watch is whether attackers start using the bug. A listing in the CISA catalog or reports of real attacks would raise the pressure on anyone still running old runtimes, especially servers that fetch user-supplied URLs. The second is the long tail of software that bundles Brotli quietly, from desktop apps to operating system packages, where fixes arrive slowly. This week curl changed how it handles vulnerability reports because AI tools are flooding maintainers, and Brotli shows the other side: AI finding real bugs faster than downstream projects can ship fixes.

The third is what else OpenAI's red-team found. Its post says it has disclosed numerous other vulnerabilities that are not yet public. If those are in widely shared components like Brotli, more coordinated patch rushes are likely, and maintainers will be asked to move at the speed of the models finding the bugs.