Brotli compression flaw allows remote code execution without login

A vulnerability in Brotli, a compression library used across Node.js, Bun, and Envoy, allowed remote code execution without any authentication.

OpenAI disclosed the flaw in October 2026. An attacker could trigger it by sending carefully crafted compressed data to a vulnerable server. No login, no credentials, no prior access needed.

The frustrating part is that the root cause had actually been fixed in the source code back in February. But no updated release was published. The fix sat in the repository for months while production systems kept shipping the vulnerable version.

That gap, a fix that exists but never reaches users, is a recurring pattern in software security. It is also a pattern that is getting more dangerous as AI tools make it easier to find and exploit such flaws.

Developers using Node.js, Bun, or Envoy were urged to update immediately once the disclosure landed.