Greg Brockman on X: "we've found and have been working on disclosure for a remote code ...

X • October 24, 2026

Greg Brockman @gdb we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software: OpenAI @OpenAI 5h During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their 11:25 PM · Oct 23, 2026 · 170.2K Views 101

Dan Lorenc @lorenc_dan 4h I think we all need to start spending as much time rewriting these things as we all are scanning and patching them. Or more. I don't see any other way here. 5

Paul Yaw @therealyawpower 1h Why the fuck are you offering clues? Keep your fucking mouth shut until the fix can be deployed. 1

Am_Tortol @am_tortl 4h I fuckin hate broccoli ngl

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Node.js Brotli Vulnerability CVE-2026-111497 Allows Remote Code Execution On October 21, 2026, Node.js released security updates for versions 22.x, 24.x, and 26.x to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decoder that could allow remote code execution. The flaw affects any application that decompresses Brotli data controlled by an attacker, including those using the built-in fetch() or body-parser. Users are advised to upgrade to patched versions 22.23.4, 24.22.1, or 26.12.1. The vulnerability has a CVSS score of 9.2, indicating its critical nature. Although a public proof-of-concept was released on October 22, no active exploitation has been reported in the wild. Other vulnerabilities were also patched in this release, including issues related to TLS certificate validation and DNS resolution. Organizations using Node.js are urged to verify their versions and apply updates promptly. 113 sources 73

Extracted Entities

Greg Brockman on X: "we've found and have been working on disclosure for a remote code ...

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (2)