OpenAI red-teaming finds unauthenticated RCE flaw in Brotli compression library, tracked as CVE-2026-111497

OpenAI says its red-teaming exercise found a vulnerability allowing unauthenticated remote code execution in Brotli, a widely-deployed compression library included in software such as Node.js, Bun and Envoy. The flaw is tracked as CVE-2026-111497 and affects software that decompresses malicious Brotli data.

Detected & updated continuously · Source: Nebula