---
type: "post"
id: "openai-s-patch-the-planet-discloses-brotli-decoder-ad9480"
slug: "openai-s-patch-the-planet-discloses-brotli-decoder-ad9480"
title: "OpenAI's Patch the Planet discloses Brotli decoder RCE CVE-2026-111497 affecting Node.js, Bun and Envoy"
description: "Patch the Planet has published an advisory for CVE-2026-111497, a vulnerability in the Google Brotli decoder."
retrieval_nugget: "Patch the Planet has published an advisory for CVE-2026-111497, a vulnerability in the Google Brotli decoder."
published_at: "2026-10-24"
updated_at: "2026-10-24"
record_date: "2026-10-24"
date_kind: "published_at"
topics: ["google"]
entities: ["OpenAI","Patch the Planet","Google Brotli","Node.js","Bun","Envoy Proxy","Istio","CVE-2026-111497"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Adds fixed release versions and deployment guidance across Node.js, Bun, Envoy, Istio and upstream Brotli, plus affected scenarios and embedded/native software to check."
prior_refs: ["memory:04f45bc0-79d6-8bf1-a03d-35dff8a20562","memory:106f4939-e4cb-8845-aad7-5e85f28fe45b","memory:6bfac591-dd8f-8bf8-a141-743c3d7a2bbc"]
source_url: "https://patchtheplanet.org/brotli"
source_urls: ["https://patchtheplanet.org/brotli"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:openai-s-patch-the-planet-discloses-brotli-decoder-ad9480"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/openai-s-patch-the-planet-discloses-brotli-decoder-ad9480/","markdown":"https://newruntime.com/posts/openai-s-patch-the-planet-discloses-brotli-decoder-ad9480.md","json":"https://newruntime.com/posts/openai-s-patch-the-planet-discloses-brotli-decoder-ad9480.json"}
---

# OpenAI's Patch the Planet discloses Brotli decoder RCE CVE-2026-111497 affecting Node.js, Bun and Envoy

## Retrieval answer

Patch the Planet has published an advisory for CVE-2026-111497, a vulnerability in the Google Brotli decoder.

Patch the Planet has published an advisory for CVE-2026-111497, a vulnerability in the Google Brotli decoder. The advisory says that applications which decode attacker-controlled Brotli data may be exposed to crashes, memory disclosure, or remote code execution. It identifies compressed HTTP requests, responses fetched from untrusted servers, and compressed files as relevant input paths.

Listed fixed releases include Node.js 22.23.4, 24.22.1, and 26.12.1; Bun 1.4.4; Envoy Proxy 1.40.0, 1.39.3, 1.38.6, and 1.37.8; and Istio 1.29.9, 1.30.6, and 1.31.2. For the upstream library, the page lists Brotli 1.0.10, 1.1.1, and 1.2.1. It says the fixed-release list was reviewed on October 23, 2026.

Until an update is deployed, the advisory recommends disabling Brotli decoding of untrusted data while retaining other compression formats where possible. It specifically notes that removing `br` from an HTTP Accept-Encoding header alone does not prevent a server from sending Brotli content.

The source does not establish which deployments are vulnerable, whether exploitation has occurred, or the prevalence of affected embedded and downstream copies of the decoder.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)