OpenAI uncovers remote code execution flaw in Brotli compression library

The bug, dubbed Node2Shell, has pushed Node.js, Bun, Envoy and Python package maintainers to ship security updates OpenAI went looking for security holes and found a big one in an unexpected place: Brotli, a widely used compression library that quietly sits inside a long list of software projects. The flaw allows remote code execution. That means an attacker could potentially run their own commands on a target machine. OpenAI disclosed it to affected projects, and Node.js is among those now pushing out security updates. The vulnerability is tracked as CVE-2026-111497 and carries a nickname, “Node2Shell,” because every serious bug apparently needs branding now. OpenAI researchers reportedly turned it up during internal security assessments of the Brotli decoder. The problem lives in that unsealing step.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Crypto Briefing.