Brotli CVE-2026-111497: 9.2 severity, patched in Node, Bun, Envoy
A decoder bug that sat fixed-but-unreleased inside Brotli for eight months went out this week in software that terminates a large share of the web's HTTPS traffic. Within hours, the UK put £100 million behind a lab meant to defend biology from the models its funders are building.
Google's CVE record rates CVE-2026-111497 at 9.2 critical on CVSS v4.0 — an out-of-bounds write in the Brotli decoder, affecting versions 1.0.3 through 1.2.0 on all platforms. The record, published October 22 with Google as the assigning authority, describes a flaw that lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. Brotli is the compression scheme behind the content-encoding: br header, and the reference decoder ships inside Node.js, Bun, Envoy and the Python packages brotli and brotlicffi — which is to say, inside a substantial portion of the infrastructure that unzips what the internet sends it.
Node's advisory explains the mechanism more concretely than the CVE text does. An invalid block switch was reported to the streaming decoder as a temporary need for more input rather than as a permanent format error, so the decoder kept appending input bytes into an eight-byte internal buffer until it overflowed. That reads like a tedious edge case and behaves like a serious one: any service that decompresses Brotli data it did not produce is running attacker-influenced input straight through the overflow.
The timeline is the part worth reading twice. In its disclosure thread, OpenAI says the root cause "was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli." That is precisely what happened. The last tagged Brotli release before this week was 1.2.0 in October 2025, so for roughly eight months the fix existed in the repository and in no artifact anyone could install. Google reserved the CVE on October 16, Brotli cut version 1.2.1 on October 21, and the record went public a day later.
The finder credited on the CVE record is "OpenAI Codex Security — Khai Tran and Sylvie Mayer," and the discovery came out of the red-teaming campaign that led OpenAI to cut live internet access from frontier model training — the campaign we covered in Today in AI — October 23, 2026. One nuance is worth keeping straight, because the simpler version will travel further and be wrong: the CVE credits two named researchers, while OpenAI's thread frames the find as the output of its red-teaming agents chaining bugs at scale. Both can be true. "An AI found it" is the claim the paperwork does least to support.
Patched versions are straightforward, and the exceptions are where the work is. Brotli shipped 1.0.10, 1.1.1 and 1.2.1, per the 1.2.1 changelog. Node.js released 22.23.4, 24.22.1 and 26.12.1 on October 21 with no workaround on offer — and 20.x, which has reached end of life, will never receive the fix. Bun patched in 1.4.4, and its advisory notes that standalone executables produced by its compile mode have to be rebuilt, not relinked. Envoy's advisory carries the same 9.2 rating across branches v1.36 through v1.39 and patches in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. The Python packages are covered from 1.2.1 and 1.2.1.0 respectively.
The danger, though, is contested, and the split is informative. Node rates the bug "high" rather than critical. Imperva published a writeup it calls Node2Shell on October 22 claiming code execution against the official Node 24.22.0 Linux arm64 image through Node's fetch implementation and the body-parser middleware, while conceding that it took multiple attempts. The Hacker News reported that the public proof of concept reached code execution only on a deliberately weakened test build, with standard builds producing a crash and a limited memory read. No in-the-wild exploitation has been reported. The honest summary for anyone running this software: patch on the normal schedule, and read "unauthenticated remote code execution" as the maintainers' severity judgment rather than a demonstrated universal exploit.
What the episode actually demonstrates is a failure mode open source keeps rediscovering — a fix merged into the default branch is not a fix shipped. Brotli's own repository publishes no security advisories at all, so the entire disclosure trail lives downstream at Node, Bun, Envoy and PyPI. A consumer watching only the upstream project saw nothing for eight months, and every release it could install stayed vulnerable the whole time. We have seen this shape before: OpenAI's agents attacked RubyGems months before the Hugging Face breach — and nobody told us.
The UK will put £100 million of government money into an AI Biosecurity Lab, and roughly two-thirds of the headline £300 million is company credits rather than cash. According to the government's announcement, OpenAI commits £100 million in compute and model credits plus trusted access for vetted biodefence developers, Anthropic commits up to £100 million in model credits and technical support, and Google DeepMind commits no funding at all — its contribution is research collaboration and a stated intent to provide trusted access to Gemini and its specialised science models. The lab is an independent non-profit modelled on the AI Security Institute rather than a directorate inside it, sitting alongside UKHSA, APHA and Dstl in a wider National AI Biosecurity Initiative.
Two things deserve separating from the announcement. The lab has no named director, no location, no headcount and no start date — the BBC reports that its role and remit are still to be settled — while the £100 million is due to be committed in Wednesday's Budget, part of a broader AI security package Reuters puts near £600 million. And the framing is the substance: a defence institution against engineered biological risk, capitalised partly by the three labs whose models are the reason that risk now has a line item. DeepMind's in-kind-only contribution answers, quietly, how much of the bet the labs are prepared to fund themselves.
What to watch: whether a reliable public exploit for CVE-2026-111497 appears in the next fortnight, and whether the biosecurity lab names anyone accountable before it spends anything.
If your production stack decompresses Brotli from untrusted input, which version are you on today — and did anything tell you to check? Write to us via our contact page.
