OpenAI red-teaming found a Brotli takeover bug
Why it matters
OpenAI found an unauthenticated remote code execution flaw (CVE-2026-111497) in the Brotli compression library used by Node.js, Bun, Envoy and Istio. Fixes are out (Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Brotli 1.2.1); if you can't patch, disable Brotli decoding of untrusted data.
Read the source: OpenAI (opens in a new tab)
All hits from 24 Oct 2026More SecurityGet the daily hits by email