{"rewrite":{"id":"r_252194abb0371c6a4d1e3890","clusterId":"c_8040ffa2d8ce865fbb0f17e3","slug":"openai-finds-brotli-flaw-that-can-lead-to-remote-code-execution","model":"deepseek-v4-1-flash","headline":"OpenAI Finds Brotli Flaw That Can Lead to Remote Code Execution","summary":"OpenAI found CVE-2026-111497 in Google's Brotli compression tool. Some data compressed with Brotli can corrupt memory and allow remote code execution, putting applications built on Node.js and Bun at risk. The flaw was found during the red team exercises OpenAI runs to harden its research environment after a July 2026 incident. Google has shipped patches, and Node.js, Bun, Envoy Proxy, and Istio have released fixed versions.","whyItMatters":"A compression library buried under Node.js and Bun is the kind of layer people forget to patch, so the fix matters less than how many downstream runtimes ship it before their users do.","webCardHtml":"\u003cp\u003eThe flaw is tracked as CVE-2026-111497 and carries the nicknames Node2Shell and HTTP2Shell. OpenAI published the details through Patch the Planet, its framework for using AI to harden open source projects, after finding the bug in its own red team exercises. Google has shipped Brotli v1.2.1, v1.1.1, and v1.0.10. The runtimes that embed Brotli, Node.js and Bun among them, have their own patched releases, and OpenAI is asking for updates to be applied quickly.\u003c/p\u003e","blueskyPost":"OpenAI's Brotli flaw was found during red team exercises it runs to harden its own research environment, so the same exercise that protects OpenAI's stack surfaced a bug in Google code that Node.js and Bun depend on.","twitterPost":"OpenAI's red team exercises turned up a Brotli flaw in Google's code, and the fix now lands on Node.js, Bun, Envoy Proxy and Istio to ship.","threadsPost":"CVE-2026-111497 sits in Google's Brotli, but the patching work is spread across Node.js, Bun, Envoy Proxy and Istio, all of which have shipped fixed versions. OpenAI found it during red team exercises meant to harden its own research environment.","newsletterBlurb":"OpenAI found a memory corruption flaw in Google's Brotli compressor that can lead to remote code execution in applications built on Node.js and Bun. The bug, CVE-2026-111497, came out of OpenAI's red team exercises and is published under its Patch the Planet framework. Google has released patched Brotli versions, and the affected runtimes have their own fixes.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261026-openai-brotli-vulnerability/\",\"title\":\"OpenAI Finds Vulnerability in Google's Brotli Compression Tool Used by Node.js and Bun That Can Lead to Remote Code Execution\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4708,"outputTokens":644,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792988380,"createdAt":"2026-10-26T04:14:34.000Z","publishedAt":"2026-10-26T04:18:38.000Z","updatedAt":"2026-10-26T04:18:38.000Z"},"cluster":{"id":"c_8040ffa2d8ce865fbb0f17e3","canonicalTitle":"OpenAIがNode.jsやBunで使われているGoogle製圧縮ツール「Brotli」でリモートコード実行につながる脆弱性を発見","representativeArticleId":"a_5435f96f7a72cf9d181d7001","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-26T03:33:00.000Z","lastSeenAt":"2026-10-26T03:33:00.000Z","updatedAt":"2026-10-26T04:18:34.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261026-openai-brotli-vulnerability/","title":"OpenAIがNode.jsやBunで使われているGoogle製圧縮ツール「Brotli」でリモートコード実行につながる脆弱性を発見"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null,"pageLinks":{"healthSlugs":[],"storySlugs":[],"entities":[],"stories":[],"entitiesOk":true,"storiesOk":true}}