Node2Shell: OpenAI's Codex Security team found a Brotli decoder RCE

01What happened

Node.js published a security release on 21 October 2026 that fixed CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The advisory credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, for reporting the flaw, and Node.js contributors mcollina and aduh95 for fixing it. Google released patched Brotli versions the same day, and the GitHub advisory covering the Brotli libraries followed on 22 October.

02How it works

An invalid block switch in a Brotli stream was reported as a temporary need for more input rather than a permanent format error. The streaming decoder therefore kept appending input bytes into an eight-byte internal buffer, writing past it and corrupting adjacent decoder state. Google's record classes the bug as CWE-787 and CWE-252, an out-of-bounds write following an unchecked return value. A remote, unauthenticated attacker reaches the path with a crafted compressed stream.

03Who is affected

Brotli 1.0.3 through 1.2.0 are affected, which pulls in Node.js 22.x, 24.x and 26.x and the brotli and brotlicffi packages on PyPI. Any application that decompresses untrusted Brotli input is in scope, which for Node.js means anything passing attacker-supplied data to node:zlib. Jan Schaumann wrote on the oss-security list that other Brotli consumers are affected too, citing an Envoy security advisory.

04What to do

Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1, and Node.js to 22.23.4, 24.22.1 or 26.12.1. Rebuild or repackage anything that bundles Brotli statically, and update brotli or brotlicffi on PyPI. Node.js publishes no workaround, so patching is the only remedy.

Questions people ask

Is Node.js patched against the Brotli decoder flaw?

Node.js shipped fixes on 21 October 2026 in versions 22.23.4, 24.22.1 and 26.12.1, covering CVE-2026-111497 in all three supported release lines. The Node.js advisory lists no workaround, so upgrading is the only remedy. End-of-life lines are always affected by a security release, so unsupported branches stay exposed.

Which Brotli versions are affected by CVE-2026-111497?

Google Brotli 1.0.3 through 1.2.0 are affected, and the fixed releases are 1.0.10, 1.1.1 and 1.2.1. On PyPI the brotli package is affected below 1.2.1 and brotlicffi below 1.2.1.0. Google is the assigning CNA and rates the flaw 9.2 on CVSS v4.0, while the Node.js advisory rates its own exposure High.

How did OpenAI find the Brotli vulnerability?

Node.js credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, for reporting the flaw. The Node.js advisory does not describe the method they used, and OpenAI's own write-up could not be retrieved for this item, so no discovery detail is claimed here. Google's Brotli 1.2.1 release notes list the CVE without naming a reporter.

Am I exposed if my application does not use Node.js?

Any software that decompresses untrusted Brotli data with a vulnerable Brotli build is exposed, not only Node.js. On the oss-security list, Jan Schaumann noted that other Brotli consumers are affected, cited an Envoy security advisory, and suggested OpenSSL could be affected where it processes Brotli-compressed certificates. Schaumann also warned that some distributions rated the flaw only medium priority.

What does the Brotli decoder flaw actually corrupt?

The Brotli decoder treated an invalid block switch as a temporary need for more input instead of a permanent format error, per the Node.js advisory. The streaming decoder then kept appending input bytes to an eight-byte internal buffer, corrupting adjacent decoder state. Outcomes named by the advisories are a crash, disclosure of process memory, and remote code execution.

Sources 4 links, all fetched

1. 1nodejs.orgNode.js Advisory
2. 2github.comBrotli Advisory
3. 3github.comBrotli 1.2.1 Release
4. 4openwall.comOSS-Security Thread