FULL STORY

Brotli RCE Flaw Ripples Across Ecosystems

An unauthenticated RCE found by OpenAI's red team in Brotli prompted emergency Node.js patches, with the decoder flaw later confirmed to affect Python's ecosystem too.

2026-10-21 ~ 2026-10-24 · 3 episodes · 18 posts

Episode 1 · Node.js Ships Security Updates Across 22/24/26 Lines Fixing Brotli RCE (2026-10-21, 10 posts)

On October 21, Node.js released security updates for all maintained release lines—22.x, 24.x and 26.x (v22.23.4, v24.22.1 and v26.12.1)—fixing 4 high-severity vulnerabilities. The most severe, CVE-2026-111497 in the Brotli decoder, allows memory disclosure or arbitrary code execution when processing attacker-controlled Brotli-compressed data. Multiple developers urged users to run node -v and upgrade immediately.

Confirmed

  • The update covers the 22.x, 24.x and 26.x lines; 20.x and 25.x are out of maintenance and receive no patch
  • The worst flaw, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder enabling memory leaks or arbitrary code execution (cited by cramforce, mohamedmansour, svenai, jedisct1 and others)
  • Aikido Security dubbed the flaw "Node2Shell"; any process handling attacker-controlled Brotli data via built-in fetch() or body decompression may be affected. basedjensen claims it was found by the OpenAI Codex Security team and was successfully exploited on the official Node.js 24.22.0 image, with Node 20 left unpatched
  • jedisct1 and svenai report the fix list also includes dns.resolve truncating names containing NUL characters (CVE-2026-105482) and fullwidth-digit IP forms bypassing TLS certificate hostname verification; svenai notes two separate TLS hostname-check bypasses
  • @AIandDesign and mohamedmansour urge users below v22.23.4 to upgrade immediately due to RCE risk

Unconfirmed

  • MickeySteamboat claims the update is directly related to the recent PHP vulnerability incident; svenai only notes same-day patches, and basedjensen's "after PHP2Shell" framing leaves the link unproven
  • The claim that OpenAI Codex Security discovered Node2Shell rests solely on basedjensen's post, without official confirmation

Why it matters

Brotli is widely used in Node.js compression handling, so applications processing external compressed data via fetch() face potential remote code execution beyond server-side workloads. TLS hostname-verification bypasses could make apps trust misattributed certificates. With all three active release lines affected, many production environments need urgent upgrades, while 20.x/25.x users face unpatched risk and must consider migration or mitigations.

Episode 2 · OpenAI red team uncovers unauthenticated RCE in Brotli; patched Node.js releases out (2026-10-23, 6 posts)

During an OpenAI red team exercise, its Codex Security team found an unauthenticated remote code execution vulnerability in the widely deployed compression library Brotli (rated high; most posts cite CVE-2026-111497). Greg Brockman said the team is coordinating disclosure and fixes; patched Node.js releases are already out, and services should upgrade promptly.

Confirmed

  • The flaw is an unauthenticated RCE: an attacker only needs to send malicious compressed data to execute code on unpatched servers or clients; per @seanwbren, unpatched servers could be hijacked, and client-side exploitation (e.g., curl downloads) was also raised
  • Affected software includes Node.js, Bun, Envoy, cURL and others that bundle Brotli; Node.js 22.x/24.x/26.x are all affected
  • Researcher julianor reproduced the memory-corruption bug with a simple Node.js + Express app; key finding: patched and unpatched versions decompress differently, allowing attackers to remotely fingerprint unpatched servers
  • Fixed releases are available: Node.js 22.23.4, 24.22.1 and 26.12.1; @fekdaoui reports Codex Security used AI to patch 104 containers in an hour

Unconfirmed

  • The CVE ID differs across posts (most say CVE-2026-111497; one post says CVE-2026-11149); the exact ID awaits official clarification

Why it matters

  • Brotli is a compression format used broadly by browsers and servers and bundled in many downstream products, giving the flaw a huge attack surface; it requires no authentication, so any service accepting compressed input is exposed
  • The divergent decompression output between patched and unpatched versions enables pre-exploitation fingerprinting, complicating defense; affected services should upgrade to fixed versions as soon as possible

Episode 3 · Brotli Decoder Out-of-Bounds Write Flaw Hits Python Ecosystem (2026-10-24, 2 posts)

A critical out-of-bounds write flaw in Google's Brotli decoder (versions 1.0.3–1.2.0) exposes the Python ecosystem to pre-auth remote code execution, affecting packages with over 100 million monthly downloads, with proof-of-concept exploits already emerging.