OpenAI's security team found a critical flaw in Node.js! Compressed data can seize the server

Much of the internet's back end runs on a handful of pieces of software most people never hear about. Node.js is one of them — the engine behind countless web servers and apps. This week researchers revealed a critical flaw buried inside it, and the team that found it belongs to an AI company.

The Flaw

The vulnerability, logged as CVE-2026-111497 and nicknamed Node2Shell, sits in the Brotli decoder — the component that unpacks a common form of compressed web data. A malformed block can trick the decoder into carrying on in an invalid state and writing data outside its intended memory buffer, a classic and dangerous class of bug known as an out-of-bounds write.

In practice that can lead to remote code execution: an attacker who can get a vulnerable server to decompress hostile data may be able to run their own commands on it. Security firm Imperva publicly demonstrated such code execution against an official Node.js build. Ratings vary by source, with Google scoring it 9.2 out of 10 on the latest severity scale, and Node.js itself classing it as high severity.

Who Found It

The detail that stands out is the finder.

The bug was reported by security researchers on OpenAI's Codex security team, with the fixes implemented by Node.js's own maintainers. It is the second time in days that a critical flaw in widely used internet infrastructure has been traced to an AI lab's security efforts, after a separate critical bug in PHP. The pattern is becoming clear: the companies building frontier AI are increasingly turning their resources — and their tools — on the open-source software the whole internet depends on.

Why The Reach Is So Wide

Node2Shell is not confined to Node.js.

Because the flaw lives in the Brotli compression code rather than in one program, it reaches wherever that code is used. Reporting indicates the runtime environments Node.js and Bun, which ship their own copy of Brotli, are affected, as are the widely deployed networking components Envoy and Istio when Brotli decompression is switched on. The exposure is worst for any system that decompresses Brotli data from untrusted sources — which includes servers using Node.js's built-in web-request feature, since it asks for Brotli by default.

The Reassuring Part, And The Caveat

In fairness, this is largely a story of the system working. The flaw was found by researchers rather than criminals, responsibly disclosed, and patched: Node.js shipped fixed versions, and the underlying Brotli library has corrected releases. As of the latest reporting, there is no confirmed active exploitation in the wild, and security analysts say a fully reliable public attack tool for code execution does not yet exist.

The caveat is the usual one. A proof-of-concept has been demonstrated, patches reveal to attackers exactly where the weakness is, and the enormous number of servers running Node.js means plenty will stay unpatched for a long time. The window between 'fix released' and 'fix installed everywhere' is precisely when these flaws get exploited.

What To Watch

How quickly the vast population of Node.js and related servers actually updates. Whether a reliable exploit emerges and attackers start scanning for unpatched systems. And whether AI labs auditing core internet infrastructure becomes a durable source of safer software — or whether the same capabilities, in other hands, simply speed up the discovery of the next critical flaw.

For anyone running Node.js, Bun, or the affected networking components, the advice is direct: update to the patched versions now.