Report
OpenAI researchers find remote-code flaw in Brotli, prompting runtime patches
OpenAI says malicious compressed data could let attackers take over unpatched servers or clients without an account.
TLDR
OpenAI says the flaw could let a malicious client take over an unpatched server that accepts compressed input, or a malicious server take over an unpatched client. Brotli has released updated versions, but software that embeds the library needs its own updates. RuntimeWire reports that Node.js published patches on October 21 and identifies the flaw as CVE-2026-111497.
Combined views
4.5K
2 Sources, first seen ago