A memory-corruption bug in Google’s Brotli decoder has turned into a patching job for teams running Node.js, Bun, Envoy or Python services that read Brotli data. The CVE record for CVE-2026-111497 rates it 9.2, or critical, under CVSS 4.0 and says a crafted stream can let a remote, unauthenticated attacker corrupt memory, leak data, crash a process or potentially run code.
OpenAI’s Codex Security team found it. In a post on X on Friday, OpenAI said the bug turned up while agents red-teamed its frontier training environment, the same work it described when it explained why its models now train without live internet access. The company said the flaw cuts both ways: “an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl –compressed”) could be taken over by a malicious server.”
The repair was already sitting in the code
A Google engineer committed a change titled “Detect and report invalid stream earlier.” to the Brotli repository on Feb. 27. No release carried it until Wednesday, when Google published Brotli 1.0.10, 1.1.1 and 1.2.1, each listing the CVE. OpenAI said the root cause “was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli.”
Projects ship their own copies of the decoder, so each has to cut its own update. Node.js shipped fixes in its Wednesday security release, explaining that an invalid block switch was treated as a temporary need for more input instead of a format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. The fixed versions are 22.23.4, 24.22.1 and 26.12.1.
Imperva’s red team said it got code to run on the official Node.js 24.22.0 Linux arm64 image through the built-in fetch() and through Express 5 with body-parser 2, though it took multiple attempts in its setup. Version 24.22.1 rejected the same inputs, Imperva wrote. As of Saturday, no real-world attacks had been reported, and code execution hadn’t been shown on the other affected software, The Hacker News reported.
Python teams may not get a warning
The PyPI packages Brotli and brotlicffi compile the same decoder, and HTTP clients such as requests, httpx and aiohttp use them automatically whenever they’re installed, according to security firm Aikido, which counts 82.8 million monthly downloads for Brotli. The fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0. Aikido said that on Friday the advisory databases still didn’t map the CVE to either package, so pip-audit, Dependabot and Safety wouldn’t flag old versions. Python advisory entries, including PYSEC-2026-4322, were added the same day.
Bun is patched in version 1.4.4. Envoy is exposed only where a Brotli decompressor is configured, and its advisory lists fixes in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Istio picked up the Envoy fix in 1.29.9, 1.30.6 and 1.31.2.
Filtering at the edge only goes so far. Vercel added firewall rules but said they do not cover “responses your functions fetch from other servers,” in its bulletin. OpenAI’s Patch the Planet guidance tells teams that can’t patch yet to reject Brotli before any decoder touches it, and warns that “Removing br from Accept-Encoding alone does not stop a server from sending it.”
The same program figured in PHP2Shell, the PHP flaws that had web admins scrambling this week. Wired reported Saturday that researchers at Calif found those bugs partly with frontier AI tools through Patch the Planet.
Desktop software needs its own look. Electron-based apps can carry more than one copy of Brotli, the Patch the Planet page says, so admins need to check Chromium and Node.js separately, because “a fixed browser component does not establish that the embedded Node.js runtime is fixed.”
from WebProNews https://ift.tt/urqmPzk
No comments:
Post a Comment