OpenAI's Agents Found a Critical Hole in the Compression Library Inside Node, Bun, and Python. The Fix Sat in Brotli's Source Since February.
CVE-2026-111497 is an out-of-bounds write in Google Brotli's C decoder, reported through OpenAI's Codex Security work during the red-team campaign behind its offline-training announcement. Node.js shipped 22.23.4, 24.22.1, and 26.12.1 on October 21; Bun, the Python brotli bindings, and proxies that decompress Brotli are in the blast radius. OpenAI says the fix was in Brotli's source around February with no broad consumer release until October, and Imperva's Node2Shell demonstrated code execution on an unmodified Node 24 build. We read the Node advisory and OpenAI's post.
By T.W. Ghost
Node.js shipped three security releases today, October 21, 2026: 22.23.4, 24.22.1, and 26.12.1. The bug they fix is not in Node. It is in Google's Brotli, the compression library Node, Bun, Python's bindings, and a number of proxies decompress with, and it was found by OpenAI's agents.
CVE-2026-111497 is an out-of-bounds write in Brotli's C decoder, affecting the 1.0.3 to 1.2.0 range per the advisories and fixed in patched Brotli releases. OpenAI's Codex Security work reported it during the red-team campaign that led to its offline-training announcement two days later. The part that should bother anyone who ships software is the timeline: OpenAI says the fix landed in Brotli's source around late February, and the consumer releases that carried it to Node and friends arrived in October. Imperva's "Node2Shell" demonstration ran code on at least one unmodified Node 24 build. We read the Node advisory and OpenAI's post. Here is what held up.
What to Patch
| Runtime or package | Fixed version (per advisories) |
|---|---|
| Node.js 22 | 22.23.4 |
| Node.js 24 | 24.22.1 |
| Node.js 26 | 26.12.1 |
| Bun | 1.4.4 (secondary write-ups; verify the Bun advisory) |
| Python brotli / brotlicffi | 1.2.1 (secondary write-ups; verify) |
| Envoy / Istio | In scope when Brotli decompression is enabled (secondary; verify each advisory) |
The library is under everyone. Anything that decompresses untrusted Brotli input is in scope: HTTP servers and clients, proxies with Brotli decoding on, anything that unpacks compressed payloads from the network. Audit for the pattern, not only for the package name.
The lag is the story. A fix in source for roughly eight months is not a fix for anyone who installs releases, which is everyone. OpenAI's timeline is OpenAI's claim; the Node release date is Node's.
The severity number is contested. A 9.2 on CVSS 4.0 circulates in secondary coverage, attributed variously. Prefer the primary advisory language over any single score.
Why an AI Lab Found It
OpenAI's red team, run against its own training infrastructure with source code and vulnerability documentation in hand, surfaced a list of container-runtime and kernel issues we cover in the offline-training post. Brotli is the one that reaches software outside OpenAI, which is why it gets its own note and its own action: patch, do not read about containment. The two stories share a cause and have different readers.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| CVE-2026-111497: Brotli C decoder out-of-bounds write; Node 22.23.4, 24.22.1, 26.12.1 on Oct 21 | Verified (Node.js October 2026 security releases) |
| Reported through OpenAI Codex Security during the frontier red-team campaign | Verified (OpenAI post and Node advisory credit) |
| Fix in Brotli source since about February, consumer releases in October | Vendor (OpenAI's timeline) |
| Imperva Node2Shell demo on unmodified Node 24.22.0 ARM64 | Press and researcher (Imperva; secondary) |
| Bun 1.4.4, Python 1.2.1, Envoy/Istio in scope | Secondary; verify each ecosystem's advisory |
| CVSS 9.2 | Secondary; scorer attribution unconfirmed |
What To Do
Patch Node to the October 21 lines now; then check Bun, Python bindings, and any proxy with Brotli decompression on.
Audit the pattern: anything that decompresses Brotli from an untrusted source is in scope regardless of language.
The frontier is elsewhere: this post has no model ranking in it, on purpose. Our model comparison has the standings; the offline-training post has the rest of the red team's list.
Sources
*Not sure which of your runtimes are exposed to a library bug an AI found? Take the free 2-minute quiz and get matched. Then read why the agents were looking in the first place: OpenAI now trains its frontier models offline.*