AI News
OpenAI's Red Team Found 'Node2Shell': A Critical Brotli Flaw With a Fix That Sat Unreleased Since February
On October 23, OpenAI disclosed that its red team had found a critical vulnerability in Brotli, the compression library built into Node.js, Bun, Envoy and much of the modern web stack. The flaw, tracked as CVE-2026-111497 and already nicknamed "Node2Shell," is rated 9.2 under CVSS v4.0 — critical — and lets a remote, unauthenticated attacker corrupt a decoder's memory with a crafted compressed stream, potentially running code. The story behind it is stranger than the bug itself: the fix had been sitting in Brotli's source code since February, unrecognized as a security fix, while every piece of software bundling the library kept shipping the vulnerable decoder.
How an AI lab found it in its own training environment
The discovery traces back to September 20, when a DNS filtering lapse in OpenAI's training environment let an internal research model reach a public chatbot. OpenAI said other requests went to an offline web cache, so the model did not reach other live sites, and attributed the incident to inadequate DNS filtering. The company paused training and evaluation of its most capable models, deployed AI agents to simulate attackers and search for weaknesses, and resumed frontier reinforcement-learning training and internal inference on October 1. The Brotli flaw surfaced in that security sweep. OpenAI's framing is that red-teaming agents chained bugs at scale; the CVE record itself credits two named researchers, Khai Tran and Sylvie Mayer of OpenAI Codex Security. Both can be true — agents found the path, humans owned the report — and the distinction matters because "an AI found it" is the version of the story the paperwork least supports.
What the flaw actually does
Brotli is a compression format Google developed, and its decoder sits inside an enormous amount of software: Node.js, Bun, Envoy, Istio, Python packages, and third-party Ruby components. The flaw is an out-of-bounds write: when the decoder processes a specially formed compressed input, it can keep writing to memory beyond what was allocated for it. A remote, unauthenticated attacker who can get a crafted Brotli stream in front of a vulnerable decoder can corrupt memory, leak memory contents, crash the process, or potentially execute code. OpenAI stressed that the flaw cuts both ways: an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input — the company's example is curl with the --compressed flag — could be taken over by a malicious server. Successful exploitation is not assured in every deployment, and a proof of concept for the Node.js case has already circulated, which is the usual signal that working exploits will follow quickly.
The eight-month gap between fix and release
The timeline is the part worth reading twice. The root cause was corrected in Brotli's source code in February — the CVE record dates the original fix to February 27 — but at the time nobody recognized it as a security vulnerability, so no release followed. The last tagged Brotli release before this week was 1.2.0 in October 2025, which means for roughly eight months the fix existed in the repository and in no artifact anyone could install. Google reserved the CVE on October 16. Brotli cut version 1.2.1 on October 21, and the record went public a day later, with OpenAI's disclosure on October 23. The lesson is not that anyone was careless — an unrecognized bug fix looks identical to any other commit — but that the gap between "fixed in source" and "fixed in your dependency" is a real exposure window, and this one lasted most of a year.
What to patch
The patch list is long because the library is everywhere. Brotli itself shipped fixed versions 1.0.10, 1.1.1 and 1.2.1. Node.js released 22.23.4, 24.22.1 and 26.12.1 on October 21, with no workaround on offer; Node 20.x has reached end of life and will never receive the fix, so anything still on it needs a version upgrade, not a patch. Bun patched in 1.4.4, and its advisory notes that standalone executables produced by its compile mode have to be rebuilt, not relinked. Envoy patched across branches v1.36 through v1.39, with fixes in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12, and Istio published related updates. The Python packages Brotli and brotlicffi are covered from 1.2.1 and 1.2.1.0 respectively. OpenAI published remediation guidance on its Patch the Planet site, and cited a July incident at Hugging Face as a precedent for taking this class of flaw seriously. If you run any service that decompresses Brotli data it did not produce, that service is the priority — it is running attacker-influenced input straight through the overflow.
Why this one will be cited for a while
Two things make Node2Shell more than a routine patch Tuesday. First, it is a case study in how AI labs now find vulnerabilities: OpenAI's own training incident became a red-teaming campaign, and that campaign produced a genuine critical flaw in widely deployed infrastructure. The company says findings from the work will inform safety cases for future training and evaluation — in other words, the same agents that probe models for dangerous behavior are now probing the software around them. Second, it exposes a structural weakness in how open-source fixes propagate: a fix that nobody labels a security fix does not travel. Every downstream project had to discover, backport and ship its own update this week, and the ones that move slowest — long-term-support releases, embedded copies, internal forks — are still exposed. Patch the headline versions first, then go looking for the copies you forgot you had.