During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library

During a red-teaming exercise, OpenAI found a vulnerability in Brotli — a widely-deployed compression library built into Node.js, Bun, Envoy and more — that allows unauthenticated remote code execution. An unpatched server accepting compressed input could be taken over by a malicious client (and vice versa, e.g. 'curl --compressed'); the underlying flaw was fixed upstream in February but not recognized as a security issue, so Brotli has now cut new releases and published a CVE, with downstream projects releasing security updates. This matters because Brotli is embedded across the software stack — a single widely-shipped library can expose vast numbers of systems at once.

• OpenAI2026-10-23 22:55