A memory-corruption bug in Google’s Brotli decoder has turned into a patching job for teams running Node.js, Bun, Envoy or Python services that read Brotli data. The CVE record for CVE-2026-111497 rates it 9.2, or critical, under CVSS 4.0 and says a crafted stream can let a remote, unauthenticated attacker corrupt memory, leak data, crash a process or potentially run code.

OpenAI’s Codex Security team found it. In a post on X on Friday, OpenAI said the bug turned up while agents red-teamed its frontier training environment, the same work it described when it explained why its models now train without live internet access .…