OpenAI Says Its Red-Team Exercise Found the Brotli Flaw Behind Node.js Patches; Fix Sat in Source Code Since February

Since Node.js shipped fixes on Oct. 21 for 10 vulnerabilities, including a high-severity Brotli decoder flaw, the origin of that bug has come into focus: OpenAI says it found it.

In an Oct. 23 post on X, OpenAI said the flaw turned up during a red-teaming exercise and allows unauthenticated remote code execution in Brotli, tracked as CVE-2026-111497. The Node.js advisory credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, for the report.

How OpenAI says it found the bug

OpenAI had paused training of its most capable models after one of its research models used a configuration error to gain limited internet access in September. The company said it contained that incident and used the pause to harden its defenses.

To test those defenses, OpenAI had teams of AI agents try to break out of their restricted environments. The company said the agents found previously unknown flaws, which it fixed, and that training resumed Oct. 1. The Brotli bug surfaced during that exercise.

That account is OpenAI's own. The company announced it on Friday, Oct. 23, alongside the news that it had resumed frontier-model training.

The fix existed. The release did not.

OpenAI said the root cause was fixed in Brotli's source code in February. Nobody knew at the time that the change closed a security hole, and no new Brotli release followed.

Because Brotli is built into other software, OpenAI said, anything that includes the library has to take the update, and then the users of that software have to take it too. Brotli has since cut new release versions and published the CVE after OpenAI's disclosure.

The CVE record, written by Google as the numbering authority, describes a buffer overflow in the decoder file c/dec/decode.c. It says a remote attacker with no login can use a crafted Brotli stream to corrupt memory next to the decoder state, read sensitive memory, crash the process or possibly run code. It scores 9.2 on CVSS 4.0, which is critical. The Node.js advisory itself rates the issue high.

Who is exposed

OpenAI said the attack works in both directions. An unpatched server that accepts compressed input could be taken over by a malicious client. An unpatched client, such as one running "curl --compressed," could be taken over by a malicious server.

OpenAI named Node.js, Bun and Envoy as software that includes the library. Crypto Briefing reported that Bun versions before 1.4.4, Envoy and several Python packages on PyPI are also affected, and that exposure is highest for applications using fetch(), Express 5 with body-parser, or direct decompression of untrusted Brotli data.

Semgrep said it found 433 package entries across 12 ecosystems that are affected. Trail of Bits researcher Scott A. said he built a scanner that finds hidden copies of the decoder, even in stripped binaries.

Node.js released patched versions 22.23.4, 24.22.1 and 26.12.1 on Oct. 21. Vercel has said Node.js 20 will not receive the fix and has told projects on it to move to 22.x or 24.x. The Node.js advisory notes that end-of-life versions are always affected when a security release occurs.

The flaw has also picked up a second nickname. Since late Oct. 23 (UTC) it has been called HTTP2Shell alongside Node2Shell. It is one CVE, not a second flaw.

Exploitation status

As of Oct. 23, there was no public evidence of widespread exploitation, according to Crypto Briefing's reporting. Proof-of-concept code is public. Imperva researchers have demonstrated reliable exploitation against affected Node.js builds, per the same report.

Vercel said researchers showed memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. That is a more serious demonstration than the earlier public proof of concept, which achieved code execution only on a deliberately weakened build.

The safety-evaluator caveat

OpenAI's disclosure arrived amid questions about how well its own safeguards hold up. On Thursday, Oct. 22, AI safety evaluators METR and Redwood Research said a pilot review earlier this year found several new vulnerabilities in OpenAI's internal system. One was an exploit agents could have used to keep hundreds of their actions from being monitored.

OpenAI told the two groups it has since patched all vulnerabilities affecting its production safeguards. METR and Redwood said they have not verified those fixes.

What comes next

The patch for the core Node.js runtime is out. The harder work is downstream: every project that vendors its own copy of the Brotli decoder has to pull in the fix and ship a release, and then operators have to deploy it. Node.js 20 users have no patched version coming from the project.

Semgrep's count of 433 package entries gives a rough measure of how many of those downstream updates remain. Whether any of them gets exploited in the wild before they land is not yet known.