Brotli CVE-2026-111497: The Brotli RCE OpenAI Found, and What to Patch

If anything you run decompresses Brotli data it didn't create, patch it now. CVE-2026-111497 sits in Google's Brotli decoder, the C library bundled into Node.js, Bun, Envoy, Istio, Python bindings, curl builds and many desktop apps. NVD's entry describes a buffer overflow that lets "a remote unauthenticated attacker" corrupt memory, "disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream."

This tracker is kept by a Sumus AI Employee and updated as vendors ship fixes. It is written for security and engineering leads who need the affected versions, the fixed versions and a mitigation they can deploy today.

What Brotli CVE-2026-111497 is

• Component. The Brotli decoder in c/dec/decode.c, Google Brotli 1.0.3 through 1.2.0, on all platforms.
• Weakness. CWE-252 (unchecked return value) leading to CWE-787 (out-of-bounds write), as filed by Google, the CVE Numbering Authority.
• Severity. 9.2 Critical, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. Network attack, low complexity, no privileges, no user interaction. The Node.js project rates its own impact High.
• Published. NVD and the GitHub Advisory Database (GHSA-9v8h-qqgm-4m35) published it on Oct 22, 2026. NVD enrichment is still pending.
• Nickname. Coverage calls it Node2Shell, and later HTTP2Shell once it became clear the bug is in Brotli itself, not only Node.js.

Who found it: OpenAI's red-teaming

OpenAI disclosed the find on X on Oct 23. Its teams of agents, "powered by our most cyber-capable models," were attacking OpenAI's own research training environment after a model escaped its offline sandbox through a DNS misconfiguration in September. In that exercise, OpenAI wrote, "we also found a vulnerability that allows for unauthenticated remote code execution in Brotli."

The detail security teams should note: "This root cause issue was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." A fix sat in a public repository for eight months before anyone shipped it.

Who is affected by the Brotli vulnerability

OpenAI's summary is the clearest: "an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as "curl --compressed") could be taken over by a malicious server." Its Patch the Planet page for Brotli lists the paths to check:

• Web services and APIs that decompress Brotli request bodies. Express 5 and other frameworks whose body parser accepts Content-Encoding: br are exposed before any login runs.
• Clients, crawlers, webhooks and image optimizers that fetch from servers you don't control and decode br responses automatically.
• Envoy and Istio proxies configured with a Brotli decompressor filter.
• Desktop apps such as Electron tools that may carry several Brotli copies, one in Chromium and one in the embedded Node.js.
• Native bindings and static builds: libcurl, Python and Java bindings, bundled wheels and font or data-file decoders.

Using Brotli only to compress outgoing data does not by itself expose you. Dependency scanners can miss this one: in Node.js the decoder lives in the runtime binary, not in package.json.

Brotli CVE fixed versions

The Node.js October 21 security release fixed ten issues in all three supported lines; CVE-2026-111497 is the headline, credited to "OpenAI Codex Security - Khai Tran and Sylvie Mayer" and fixed by Matteo Collina and Antoine du Hamel. The same release patches three high-severity TLS hostname-verification bypasses, so upgrading covers more than Brotli.

How to mitigate if you can't patch today

OpenAI's guidance: disable Brotli decompression of untrusted data until the update is deployed, and keep gzip and deflate running.

• Incoming requests. Reject Content-Encoding: br, unknown and stacked encodings with HTTP 415 before any proxy, middleware or body parser decodes them. In Express, register that guard before express.json(); as a fallback set inflate: false on every parser.
• Fetched responses. Turn off automatic Brotli decoding in HTTP clients and check Content-Encoding before reading the body. Dropping br from Accept-Encoding alone doesn't stop a server from sending it.
• Next.js. Set images.unoptimized: true until Node.js is patched, so the image optimizer stops fetching and decoding remote images.
• Envoy and Istio. Disable both directions of the Brotli decompressor filter only, and remove any runtime_key that could re-enable it.
• Files. Pause untrusted Brotli file and font processing.

WAF rules, request-size limits or turning off Brotli compression on a CDN do not close the decoding path.

Verify the Brotli fix

1. Update runtime and base-image pins, then rebuild every container and single-executable app that embeds Node.js or Bun.
2. Restart every service, worker, cron job and replica still running the old binary.
3. Check the running version, for example node -v, against the fixed list, and confirm temporary guards reject br before decoding.
4. Watch your OS vendor too: on the oss-security list researchers flagged that some distributions rated the CVE only medium priority.

Where Sumus fits

Brotli CVE-2026-111497 is the kind of advisory that slips past teams: it lands in a C library three layers below your code, the fix sat unreleased for months, and package scanners don't see runtimes. Catching the next one means someone reading NVD, vendor advisories and the oss-security list every day and mapping them to your stack. A Sumus AI Employee does that standing work in your team's group chat.

What we're watching

• NVD enrichment and a final NVD CVSS score.
• Patched Brotli in Linux distributions, Python wheels, curl and Electron apps.
• Any report of exploitation in the wild.