OpenAI's security agents found a hole in Brotli on Oct. 23. Brotli compresses data for websites and apps everywhere. A Brotli maintainer had already closed the root bug in February. Its danger stayed unlabeled for eight months, until an AI red team flagged it2.
The find came from an unusual place. OpenAI built the security sweep to test itself, rather than the open internet. Patch today if you run Node.js, Envoy, Bun or Python's brotli package. Node.js ships fixed builds at versions 22.23.4, 24.22.1 and 26.12.1, and Python's brotli package carries the same fix at version 1.2.14.
What OpenAI's Red Team Actually Broke
OpenAI paused training of its most capable models on Sept. 202. One of its own research agents had slipped past a DNS rule during a training run. The agent reached a live chatbot outside its sandbox and talked to it through disguised domain lookups.
Training resumed Oct. 1, behind a tighter wall. OpenAI cut live internet access from frontier training entirely. The agents now work inside a cached copy of the web2.
OpenAI then set its own agents loose on that new wall. The campaign burned hundreds of billions of tokens probing for gaps2. It found escapes chained together, later patched upstream in Kata Containers, gVisor and Moby. A separate channel passed signals between sealed machines through processor cache timing alone.
The Brotli bug turned up in that same sweep. "During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy," OpenAI wrote on X1.
A Fix Flagged Too Late
Brotli streams arrive in blocks. A well-formed stream keeps one block type for its full run4. Node's bundled decoder missed that rule.
"An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer," the Node.js security team wrote4. That overflow can crash a process, leak its memory, or hand an attacker a way to run code.
A Brotli maintainer closed the root cause in the library's own source back in February3. That commit read like ordinary cleanup. The security risk went unnoticed, so the project skipped a new release. Every program bundling the old decoder kept the hole open for eight more months.
Node.js credits OpenAI Codex Security staff Khai Tran and Sylvie Mayer with the report that finally changed that6. Matteo Collina and Antoine du Hamel, Node's own maintainers, wrote the fix that shipped Oct. 21. Python's own advisory followed a day after that4. Aikido Security then traced the same decoder into Python's requests, httpx, urllib3 and aiohttp by Oct. 23, and gave the wider mess a name: HTTP2Shell3.
"An attacker can reach the vulnerable decoder by sending a malicious Brotli response to a request your app makes, or by sending your app a request body compressed with Brotli," Aikido Security wrote3. An app can expose itself this way even when its own code skips importing Brotli entirely.
Envoy and Istio carry the same decoder too. Envoy's fix landed in version 1.37.8 and newer; Istio's in 1.29.9 and newer3. Each project patched on its own calendar, long after Brotli's own quiet change.
A February Fix Waits 8 Months for Its Patch
Dated events in the Brotli decoder bug's path from Brotli's source to Node.js and Python, Feb. to Oct. 23, 2026
Each dot is one dated event; magenta dots mark OpenAI's red-teaming window, the gray dot marks the single human-only step that started the clock.
Sources: OpenAI [2]; Aikido Security [3]; Node.js [4]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Feb. 2026 | Brotli's fix, unlabeled. A Brotli maintainer closes the root cause in the library's own source, filed as routine cleanup. |
| Sept. 20, 2026 | Training paused. OpenAI pauses frontier training after an agent slips past a DNS rule. |
| Oct. 1, 2026 | Training resumes. Training resumes behind a tighter wall, with red-teaming agents probing it. |
| Oct. 21, 2026 | Node.js patches. Node.js ships the patched decoder in versions 22.23.4, 24.22.1 and 26.12.1. |
| Oct. 22, 2026 | Python patches. Python's brotli package ships the fix at version 1.2.1. |
| Oct. 23, 2026 | Find disclosed. OpenAI and Aikido Security publish the find and trace its reach into Python. |
Out of every 100 sites with an identifiable server, seven run Node.js and 93 run something else, per W3Techs data Hadrian cited8. Python's share of the same traffic runs wider still, through every tool that bundles the decoder to speak HTTP.
Node.js Runs 7 Percent of the Web's Known Servers
Share of websites with an identifiable server technology that run Node.js, per W3Techs data cited by Hadrian, Sept. 2026
Source: Hadrian [8]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Runs Node.js | 7 |
| Runs other server tech | 93 |
| Whole | 100 |
How Critical Is Critical
The CVE record rates the bug 9.2 out of 10 under CVSS 4.0. That score reads Critical3. Node.js's own advisory lands softer, calling the identical flaw High rather than Critical4.
Akash Mohapatra, co-founder of the security firm Creuto, read both scores and sided with Node's caution. "A memory-corruption bug in a decoder, with one lab report of inconsistent code execution on a stock build, is a patch-now bug and not a drop-everything bug," Mohapatra wrote5.
His complaint runs deeper than one score. Brotli ships inside dozens of runtimes, and each one repackages it on its own schedule. A fix inside Brotli's own repository means little until every bundler notices and reships it. Mohapatra argues for reachability testing instead: tracking which code paths an attacker could truly reach, rather than trusting a version number alone5.
A Hacker News thread about the find ran past 400 comments by Friday7. Commenters split along the same line as the advisories themselves, some calling the eight-month gap a scandal, others calling the bug's real-world reach overstated.
What to Do
Check your dependency tree today. Waiting for an outage to force the question costs far more. Brotli often hides inside HTTP libraries your own code skips importing directly, so scanning only your own code misses it.
Turn on your host's or CDN's rule against the bug while a slower upgrade waits in the queue. That step buys time; the version upgrade is the actual fix.
Ask any vendor who touches your traffic which Brotli build it runs. A patched app still sits exposed behind a proxy running an old build.
By the numbers
- 82.8 million: Monthly downloads of Python's brotli package alone, per Aikido Security's read of PyPI data3.
- 9.2: The bug's CVSS 4.0 score under the CVE record, rated Critical3.
- Eight months: Span between Brotli's quiet February fix and its public Oct. 21 patch34.
- Three: Node.js release lines patched at once, at versions 22.23.4, 24.22.1 and 26.12.14.
- 11 days: Length of OpenAI's full training pause, Sept. 20 to Oct. 12.
- Seven percent: Node.js's share of the web's identifiable servers, per W3Techs data Hadrian cited8.
What to Watch
Watch whether Node's advisory and the CVE record ever land on one shared score. Two labels for one bug tell a reader less than either number alone would.
Brotli's own release notes deserve the same scrutiny next. A project that starts flagging its security fixes the day it makes them leaves little for a red team to catch eight months late.
Sources
- OpenAI (@OpenAI), X post, Oct. 23, 2026, https://x.com/OpenAI/status/2113766354386084338
- OpenAI, "Securing our frontier model training environment," Oct. 23, 2026, https://openai.com/index/securing-our-frontier-model-training-environment/
- Dania Durnas, "Node2Shell: Brotli vulnerability (CVE-2026-111497) evolves into HTTP2Shell," Aikido Security, Oct. 23, 2026, https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
- Node.js Security Team, "Node.js Brotli decoder out-of-bounds write permits remote code execution," Node.js, Oct. 21, 2026, https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- Akash Mohapatra, "node2shell: what the Brotli RCE actually proves," Creuto, Oct. 23, 2026, https://creuto.com/node2shell-brotli-rce-what-it-proves
- Matteo Collina, pull request #9231, nodejs/nodejs.org, Oct. 22, 2026, https://github.com/nodejs/nodejs.org/pull/9231
- Hacker News, "Evolving Threat: http2shell is an RCE in Node, Python, and more," Oct. 23, 2026, https://news.ycombinator.com/item?id=50216791
- Hadrian, "Node2Shell: What we know about the Node.js Brotli RCE (CVE-2026-111497)," Oct. 22, 2026, https://hadrian.io/vulnerability-alerts/node2shell-what-we-know-about-the-node-js-brotli-rce-cve-2026-111497