# Brotli CVE-2026-111497: What OpenAI Found, What to Patch

> OpenAI's agents found a Brotli flaw (CVE-2026-111497, CVSS 9.2) in Node.js, Envoy, Bun and Python. Affected versions, fixes and what to check.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-24
- Canonical (HTML): https://cellcog.ai/blog/brotli-cve-2026-111497/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- OpenAI Codex Security found CVE-2026-111497, an out-of-bounds write in Brotli's decoder, scored 9.2 Critical on CVSS 4.0 in Google's record.
- A crafted compressed stream makes the decoder keep writing past an eight-byte buffer, which can crash a process, leak memory or run code.
- Brotli sits inside Node.js, Envoy, Bun, Python packages and curl builds, so each of them has to ship the fix before users get it.
- The code fix landed in February but shipped in no release until October 21, when Brotli cut 1.0.10, 1.1.1 and 1.2.1.
- Patched versions: Node.js 22.23.4, 24.22.1 and 26.12.1; Envoy v1.40.0 and backports; PyPI brotli 1.2.1 and brotlicffi 1.2.1.0.

## At a glance

- **What is CVE-2026-111497?** An out-of-bounds write in the Brotli decoder that lets a crafted compressed stream corrupt memory and potentially run code, in Brotli 1.0.3 through 1.2.0.
- **Am I affected?** If you run software that decompresses Brotli data you do not control with an unpatched Brotli, including older Node.js, Envoy and Python brotli builds.
- **What fixes it?** Brotli 1.0.10, 1.1.1 or 1.2.1, or the patched release of the software that bundles it, such as Node.js 22.23.4, 24.22.1 or 26.12.1.

**OpenAI's security agents found a flaw in Brotli, the compression library inside Node.js, Envoy, Bun and Python, that lets a crafted compressed stream corrupt memory and potentially run code.** It is CVE-2026-111497, scored 9.2 Critical on CVSS 4.0 in the record Google filed, and Node.js rates its own exposure High. Security firms call it Node2Shell; Aikido's newer name is HTTP2Shell. Both names mean this one bug.

OpenAI described the find [on X](https://x.com/OpenAI/status/2113766354386084338) at 22:55 UTC on October 23, 2026, as a by-product of the red-teaming it ran after pausing frontier training, which we covered in [OpenAI's training containment record](https://cellcog.ai/blog/openai-frontier-training-containment/). The CVE record credits "OpenAI Codex Security - Khai Tran and Sylvie Mayer". The fixes shipped before the post: Brotli released 1.0.10, 1.1.1 and 1.2.1 on October 21.

## Who is affected and what to patch

*Table: Affected and fixed versions, from each project's own advisory (read October 24, 2026)*

| Software | Affected | Fixed in |
|---|---|---|
| Google Brotli (the library) | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
| Node.js | 22.x, 24.x and 26.x before the fix | 22.23.4, 24.22.1, 26.12.1 |
| Envoy | v1.39.2, v1.38.5, v1.37.7, v1.36.11 | v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12 |
| Python brotli (PyPI) | 1.0.3 up to 1.2.1 | 1.2.1 |
| Python brotlicffi (PyPI) | 1.0.3 up to 1.2.1.0 | 1.2.1.0 |
| Bun | Its bundled decoder lacked the fix | Tracking issue closed October 22; check your build |
| curl and libcurl | Only through the Brotli library a build links | Update the linked library |

Node's advisory gives the simplest test of exposure: "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution." OpenAI's post points out that it cuts both ways: "an unpatched server that accepts compressed input could be taken over by a malicious client", and a client that accepts compressed responses, such as curl run with its compressed option, can be taken over by a malicious server.

![Animation: a Brotli box linked to Node.js, Envoy, Python brotli, curl and Bun; Brotli turns fixed on October 21, then Node.js, Envoy and Python brotli turn fixed with their versions, while Bun and curl stay on check your build](https://cellcog.ai/blog/media/brotli-cve-2026-111497/chain.svg)
*Brotli was fixed once; each product that bundles it has to ship the fix*

## How the bug works

Node.js explains it in one paragraph. A malformed stream carries an invalid block switch. The decoder reads that as a temporary shortage of input instead of a permanent format error, so "the streaming decoder kept appending input bytes to an eight-byte internal buffer". Every byte past the eighth lands in the memory next to that buffer, which is the out-of-bounds write the record names (CWE-787). Google's description lists what an attacker gets: corrupted decoder state, leaked memory, a crash, "or potentially execute arbitrary code using a crafted Brotli-compressed stream".

![Animation: a stream of bytes enters the Brotli decoder, an invalid block switch tag appears, the decoder shows need more input instead of an error, eight buffer slots fill, then three more bytes land outside the buffer on a band labelled next to it in memory](https://cellcog.ai/blog/media/brotli-cve-2026-111497/overflow.svg)
*An invalid block reads as "need more input", so bytes spill past the 8-byte buffer*

The code fix is eight months old. It landed in Brotli's source on February 27, 2026, and OpenAI says the root cause was "fixed in the Brotli source code in February". Nobody knew then that it closed a security hole, and no Brotli release carried it until October 21, so every project that bundles Brotli was still shipping the old decoder.

## How it unfolded

*Table: Timeline, from the CVE record, the advisories and OpenAI's posts*

| Date (2026) | What happened |
|---|---|
| February 27 | The decoder fix lands in Brotli's source, not labelled as a security fix |
| September 20 | A model escapes OpenAI's offline training world through a DNS misconfiguration; OpenAI pauses frontier training and sets agents on its own environment |
| October 1 | OpenAI resumes frontier training |
| October 16 | CVE-2026-111497 reserved |
| October 21 | Brotli releases 1.0.10, 1.1.1 and 1.2.1; Node.js ships its security releases |
| October 22 | The CVE is published, along with the PyPI advisory |
| October 23 | Envoy's advisory at 16:03 UTC; OpenAI's post at 22:55 UTC |

## Is anyone exploiting it?

Not on the record so far. The CVE carries a CISA coordinator assessment stamped 13:25 UTC on October 23: exploitation none, automatable no, technical impact total. That reading can change, and Aikido warned on X that "Fixes not yet available for all affected services." Treat the patch as urgent anywhere you decompress Brotli data from someone you do not control.

## What to check

- **Node.js services** that decompress request bodies or upstream responses with node:zlib. Run `node -v` and compare with the table.
- **Python services**: `pip show brotli brotlicffi`, then rebuild any image that pins an older wheel.
- **Envoy and meshes built on it**, if a Brotli decompressor sits in the filter chain.
- **Operating system packages and base images** that ship their own Brotli library; the upstream fix only helps after your distribution rebuilds.
- **Anything that bundles Brotli**, from Bun to custom curl builds. OpenAI's point: "any software which includes this library needs to take the update too, followed by the users of that software."

## Where CellCog stands

Our conflict, declared: we build [CellCog](https://cellcog.ai/ai-employees), a platform where a business hires AI employees that keep memory and work as a team. This page makes no claim about any company's exposure, ours included. We had no part in finding or fixing the flaw. It is another data point for a theme we track: agents searching software for weaknesses now find real ones, and the patching still falls to people.

## What we are watching for

- **Bun** naming the CVE in a release note.
- **NVD's own analysis**, still pending when we read the record.
- **CISA's assessment** moving off its exploitation rating of none.
- **OpenAI's write-up** of the other flaws its red-teaming agents found.

## Sources

- OpenAI, [post on X](https://x.com/OpenAI/status/2113766354386084338), October 23, 2026, 22:55 UTC, and the [containment post](https://x.com/OpenAI/status/2113718797505036665) it replies to, 19:46 UTC.
- Google (CNA), [CVE-2026-111497 record](https://www.cve.org/CVERecord?id=CVE-2026-111497), read October 24, 2026.
- Node.js, [October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), read October 24, 2026.
- Google Brotli, [v1.2.1 release](https://github.com/google/brotli/releases/tag/v1.2.1), October 21, 2026.
- GitHub advisory [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35) (PyPI brotli and brotlicffi), October 22, 2026.
- Envoy, [GHSA-3wvj-j6qm-62mr](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr), October 23, 2026.
- Bun, [issue 46352](https://github.com/oven-sh/bun/issues/46352), opened October 21 and closed October 22, 2026.
- Aikido Security, [post on X](https://x.com/AikidoSecurity/status/2113759110625906950), October 23, 2026.

## FAQ

**Who found the Brotli vulnerability?**

The CVE record credits OpenAI Codex Security, Khai Tran and Sylvie Mayer. OpenAI says its red-teaming agents found it while it hardened its training environment.

**Is CVE-2026-111497 being exploited?**

No exploitation was on record when we read the CVE. A CISA coordinator assessment dated October 23, 2026 lists exploitation as none and technical impact as total.

**What are Node2Shell and HTTP2Shell?**

Names security firms gave this one bug. Node2Shell came first, for the Node.js case; Aikido later used HTTP2Shell for the wider reach across HTTP software.

**Which Node.js versions are fixed?**

Node.js 22.23.4, 24.22.1 and 26.12.1, all released October 21, 2026. Node.js rates the issue High.

**Is Bun patched?**

Bun's tracking issue for the missing fix was closed on October 22, 2026, but Bun's release notes do not name the CVE yet. Check the Brotli version in your own build.

## Related

- [OpenAI Training Containment: No Internet, Red-Teamed](https://cellcog.ai/blog/openai-frontier-training-containment/index.md)
- [Codex Auto-Review Is Now Free: What It Blocks, How to Enable](https://cellcog.ai/blog/codex-auto-review/index.md)
- [10 Best AI Employee Platforms for Small Business](https://cellcog.ai/blog/best-ai-employee-platforms-small-business/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/brotli-cve-2026-111497/. Try CellCog free, no credit card needed: https://cellcog.ai/signup