OpenAI went looking for security holes and found a big one in an unexpected place: Brotli, a widely used compression library that quietly sits inside a long list of software projects.
The flaw allows remote code execution. That means an attacker could potentially run their own commands on a target machine. OpenAI disclosed it to affected projects, and Node.js is among those now pushing out security updates.
What OpenAI found
The vulnerability is tracked as CVE-2026-111497 and carries a nickname, “Node2Shell,” because every serious bug apparently needs branding now. OpenAI researchers reportedly turned it up during internal security assessments of the Brotli decoder.
The problem lives in that unsealing step. Researchers traced it to an out-of-bounds write, which can be triggered by compressed input that has been crafted with malicious intent.
A booby-trapped package can trick the decoder into writing data into memory it was never supposed to touch. Once an attacker can scribble outside the lines like that, running their own code is often the next stop.
The flaw is rated high severity with a critical CVSS score of 9.2. CVSS is the industry’s standard scale for grading vulnerabilities, and scores at that level tend to send security teams scrambling.
Two details make the rating especially uncomfortable. The attack is unauthenticated, so no login is needed. And it can hit both the client side and the server side, which covers apps fetching data and the machines serving it.
Who has to patch, and how fast
After discovery, the bug was reported to several key projects, setting off a coordinated response. Node.js released patched versions 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026.
Those releases weren’t a one-issue affair. The same security update addressed nine additional vulnerabilities, including multiple TLS hostname-check bypasses, so the patch window is busier than usual.
Node.js isn’t alone. Bun versions prior to 1.4.4 are affected, as is Envoy, along with several Python packages on PyPI.
Exposure is highest for applications that use fetch(), Express 5 with body-parser, or that decompress untrusted Brotli data directly.
As of October 23, 2026, there was no public evidence of widespread exploitation. That’s the good news.
The less good news: proof-of-concept code has emerged. Researchers at Imperva have also demonstrated that the vulnerability can be reliably exploited against affected Node.js builds.
A fix that waited months for its moment
The timeline has an odd wrinkle. The root cause fix was committed to Brotli’s source code back in February 2026. The issue wasn’t formally disclosed until October 2026.
That gap reflects a structural headache in open source. Many applications bundle their own copy of Brotli instead of relying on the version installed on the operating system.
So fixing the library upstream is only step one. Every project carrying a private copy has to pull in the change, cut a release, and then convince users to actually install it.
This dynamic helps explain why coordinated disclosure matters. Reporting the bug directly to downstream projects like Node.js gave maintainers a chance to prepare fixes before the details went fully public.
What this means
For engineering teams, the immediate task is unglamorous but urgent: figure out where Brotli lives in the stack. That includes bundled copies inside runtimes, proxies and Python dependencies, not just the obvious places.
Teams running Node.js should move to the patched 22.23.4, 24.22.1 or 26.12.1 releases. Bun users on anything older than 1.4.4 have a similar to-do item, and Envoy and PyPI package users need to check their versions.
Prioritization is fairly clear from the research. Any service that accepts or fetches compressed data from sources it doesn’t control should go to the front of the line.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.