OpenAI red team uncovers unauthenticated Brotli RCE affecting Node.js, Bun and cURL
charliermarsh · x · 2026-10-24
During a red-teaming exercise, OpenAI discovered an unauthenticated remote code execution vulnerability in Brotli, a widely deployed compression library used in Node.js, Bun, Envoy and more. An attacker can run arbitrary code on affected systems simply by sending maliciously compressed data — no account needed.
- Affected setups include Express.js apps using express.json() and cURL clients with the --compressed flag
- Found and disclosed by OpenAI's red team, with credit to ktr4n and the team
- The root cause is fixed in Brotli source; downstream projects should patch promptly
More from Safety
- New Royal Society paper: EU AI policy should optimize for happiness — SandraWachter5 · 2026-10-26
- Is Browsing Safe After PHP2Shell? Security Expert: Patch PHP Servers Now — altryne · 2026-10-26
- AGMAI advises AI labs against designating mathematicians to vet model math outputs — AlexKontorovich · 2026-10-26
- Matthew Green: hard-to-reach vulnerable core code needs systematic AI-driven testing — matthew_d_green · 2026-10-26
- Zvi digests Gemini 4 Argon cards: 217-page safety report, 0.7% injection success — TheZvi · 2026-10-26
- Bitcoin-loaded honeypot site with $2,021 bounty hacked and drained in under 20 hours — Polymarket · 2026-10-26