OpenAI disclosed a remote code execution vulnerability in the Brotli compression library, affecting widely used software including Node.js, Bun, and Envoy. The flaw allows attackers to compromise unpatched servers by sending malicious compressed data or to take over clients through a malicious server, all without authentication. The root cause was patched in the Brotli source code in February 2026 but was not flagged as a security issue at the time. Tracked as CVE-2026-111497, the vulnerability prompted Node.js to release a fixed version on October 21, with all dependent software urged to update accordingly.