Brotli vulnerability could let unauthenticated attackers run code remotely

OpenAI says its red team found a remote-code-execution flaw in Brotli, a compression library used by Node.js, Bun and Envoy. An attacker could send malicious compressed data to an unpatched server or serve it to an unpatched client, without an account. OpenAI says the root cause was fixed in Brotli’s source in February, but no newer release had followed. Brotli has since issued new versions and a CVE; downstream projects have released or are releasing security updates.