OpenAI Red Team Uncovers Unauthenticated RCE Flaw in Brotli

OpenAI's red team found an unauthenticated remote code execution vulnerability in the widely deployed compression library Brotli (CVE-2026-11149), affecting Node.js, Bun, Envoy and other software; Greg Brockman says disclosure and coordinated fixes are underway.

2026-10-24 ~ 2026-10-24 · 2 related posts

• OpenAI red team finds critical Brotli RCE (CVE-2026-11149) hitting Node.js, Bun, Envoy — moyix · 2026-10-24
• OpenAI red team finds unauthenticated RCE in widely deployed Brotli compression library — gdb · 2026-10-24