ChainCatcher report: OpenAI posted on X that during a recent red team exercise, they discovered a remote code execution vulnerability in the widely used compression library Brotli, exploitable without authentication. Software such as Node.js, Bun, and Envoy all include this library. Attackers can take control of unpatched servers by sending malicious compressed data, or compromise clients that accept compressed data via malicious servers. OpenAI stated that the root cause of this issue was fixed in the Brotli source code in February of this year, but it was not recognized as a security vulnerability at the time; all software incorporating this library must update accordingly. According to The Hacker News, the vulnerability is designated as CVE-2026-111497, and Node.js has released a patched version as of October 21.
OpenAI Discovers Remote Code Execution Vulnerability in Brotli Compression Library
ChaincatcherShare
Summary
OpenAI discovered a remote code execution vulnerability in the Brotli compression library during a red team exercise. The flaw allows attackers to exploit maliciously crafted data to take control of unpatched systems. A fix was incorporated into Brotli’s source code in February 2026, but it was not initially classified as a security issue. Affected tools include Node.js, Bun, and Envoy. Node.js released a patch on October 21, 2026. If systems remain unpatched, automated smart contract execution and on-chain data integrity could be compromised.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.