OpenAI: The red team testing found a remote code execution vulnerability in the Brotli compression library

OpenAI posted on the X platform that during a recent red team exercise, a vulnerability was discovered in the widely used compression library Brotli that allows remote code execution without authentication. Software such as Node.js, Bun, and Envoy all have this library built-in. Attackers can take over unpatched servers by sending malicious compressed data, and they can also take over clients that accept compressed data through malicious servers.

OpenAI stated that the root of the issue was fixed in the Brotli source code in February of this year, but it was not identified as a security vulnerability at that time, and all software that includes this library needs to be updated accordingly. According to The Hacker News, the vulnerability is numbered CVE-2026-111497, and Node.js released a patched version on October 21.