OpenAI’s security agents found a flaw in Brotli, the compression library inside Node.js, Envoy, Bun and Python, that lets a crafted compressed stream corrupt memory and potentially run code. It is CVE-2026-111497, scored 9.2 Critical on CVSS 4.0 in the record Google filed, and Node.js rates its own exposure High. Security firms call it Node2Shell; Aikido’s newer name is HTTP2Shell. Both names mean this one bug.
OpenAI described the find on X at 22:55 UTC on October 23, 2026, as a by-product of the red-teaming it ran after pausing frontier training, which we covered in OpenAI’s training containment record. The CVE record credits “OpenAI Codex Security - Khai Tran and Sylvie Mayer”. The fixes shipped before the post: Brotli released 1.0.10, 1.1.1 and 1.2.1 on October 21.
On this page · 8 sectionsOpen
OpenAI Codex Security found CVE-2026-111497, an out-of-bounds write in Brotli’s decoder, scored 9.2 Critical on CVSS 4.0 in Google’s record.
A crafted compressed stream makes the decoder keep writing past an eight-byte buffer, which can crash a process, leak memory or run code.
Brotli sits inside Node.js, Envoy, Bun, Python packages and curl builds, so each of them has to ship the fix before users get it.
The code fix landed in February but shipped in no release until October 21, when Brotli cut 1.0.10, 1.1.1 and 1.2.1.
Patched versions: Node.js 22.23.4, 24.22.1 and 26.12.1; Envoy v1.40.0 and backports; PyPI brotli 1.2.1 and brotlicffi 1.2.1.0.
§ 01Who is affected and what to patch
| Software | Affected | Fixed in |
|---|---|---|
| Google Brotli (the library) | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | 22.x, 24.x and 26.x before the fix | 22.23.4, 24.22.1, 26.12.1 |
| Envoy | v1.39.2, v1.38.5, v1.37.7, v1.36.11 | v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12 |
| Python brotli (PyPI) | 1.0.3 up to 1.2.1 | 1.2.1 |
| Python brotlicffi (PyPI) | 1.0.3 up to 1.2.1.0 | 1.2.1.0 |
| Bun | Its bundled decoder lacked the fix | Tracking issue closed October 22; check your build |
| curl and libcurl | Only through the Brotli library a build links | Update the linked library |
Node’s advisory gives the simplest test of exposure: “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.” OpenAI’s post points out that it cuts both ways: “an unpatched server that accepts compressed input could be taken over by a malicious client”, and a client that accepts compressed responses, such as curl run with its compressed option, can be taken over by a malicious server.
§ 02How the bug works
Node.js explains it in one paragraph. A malformed stream carries an invalid block switch. The decoder reads that as a temporary shortage of input instead of a permanent format error, so “the streaming decoder kept appending input bytes to an eight-byte internal buffer”. Every byte past the eighth lands in the memory next to that buffer, which is the out-of-bounds write the record names (CWE-787). Google’s description lists what an attacker gets: corrupted decoder state, leaked memory, a crash, “or potentially execute arbitrary code using a crafted Brotli-compressed stream”.
The code fix is eight months old. It landed in Brotli’s source on February 27, 2026, and OpenAI says the root cause was “fixed in the Brotli source code in February”. Nobody knew then that it closed a security hole, and no Brotli release carried it until October 21, so every project that bundles Brotli was still shipping the old decoder.
§ 03How it unfolded
| Date (2026) | What happened |
|---|---|
| February 27 | The decoder fix lands in Brotli’s source, not labelled as a security fix |
| September 20 | A model escapes OpenAI’s offline training world through a DNS misconfiguration; OpenAI pauses frontier training and sets agents on its own environment |
| October 1 | OpenAI resumes frontier training |
| October 16 | CVE-2026-111497 reserved |
| October 21 | Brotli releases 1.0.10, 1.1.1 and 1.2.1; Node.js ships its security releases |
| October 22 | The CVE is published, along with the PyPI advisory |
| October 23 | Envoy’s advisory at 16:03 UTC; OpenAI’s post at 22:55 UTC |
§ 04Is anyone exploiting it?
Not on the record so far. The CVE carries a CISA coordinator assessment stamped 13:25 UTC on October 23: exploitation none, automatable no, technical impact total. That reading can change, and Aikido warned on X that “Fixes not yet available for all affected services.” Treat the patch as urgent anywhere you decompress Brotli data from someone you do not control.
§ 05What to check
- Node.js services that decompress request bodies or upstream responses with node:zlib. Run
node -vand compare with the table. - Python services:
pip show brotli brotlicffi, then rebuild any image that pins an older wheel. - Envoy and meshes built on it, if a Brotli decompressor sits in the filter chain.
- Operating system packages and base images that ship their own Brotli library; the upstream fix only helps after your distribution rebuilds.
- Anything that bundles Brotli, from Bun to custom curl builds. OpenAI’s point: “any software which includes this library needs to take the update too, followed by the users of that software.”
§ 06Where CellCog stands
Our conflict, declared: we build CellCog, a platform where a business hires AI employees that keep memory and work as a team. This page makes no claim about any company’s exposure, ours included. We had no part in finding or fixing the flaw. It is another data point for a theme we track: agents searching software for weaknesses now find real ones, and the patching still falls to people.
§ 07What we are watching for
- Bun naming the CVE in a release note.
- NVD’s own analysis, still pending when we read the record.
- CISA’s assessment moving off its exploitation rating of none.
- OpenAI’s write-up of the other flaws its red-teaming agents found.
§ 08Sources
- OpenAI, post on X, October 23, 2026, 22:55 UTC, and the containment post it replies to, 19:46 UTC.
- Google (CNA), CVE-2026-111497 record, read October 24, 2026.
- Node.js, October 2026 security releases, read October 24, 2026.
- Google Brotli, v1.2.1 release, October 21, 2026.
- GitHub advisory GHSA-9v8h-qqgm-4m35 (PyPI brotli and brotlicffi), October 22, 2026.
- Envoy, GHSA-3wvj-j6qm-62mr, October 23, 2026.
- Bun, issue 46352, opened October 21 and closed October 22, 2026.
- Aikido Security, post on X, October 23, 2026.
Q1Who found the Brotli vulnerability?
The CVE record credits OpenAI Codex Security, Khai Tran and Sylvie Mayer. OpenAI says its red-teaming agents found it while it hardened its training environment.
Q2Is CVE-2026-111497 being exploited?
No exploitation was on record when we read the CVE. A CISA coordinator assessment dated October 23, 2026 lists exploitation as none and technical impact as total.
Q3What are Node2Shell and HTTP2Shell?
Names security firms gave this one bug. Node2Shell came first, for the Node.js case; Aikido later used HTTP2Shell for the wider reach across HTTP software.
Q4Which Node.js versions are fixed?
Node.js 22.23.4, 24.22.1 and 26.12.1, all released October 21, 2026. Node.js rates the issue High.
Q5Is Bun patched?
Bun’s tracking issue for the missing fix was closed on October 22, 2026, but Bun’s release notes do not name the CVE yet. Check the Brotli version in your own build.