An OpenAI security review prompted by an internal research model reaching the internet through a DNS misconfiguration helped uncover a serious Brotli vulnerability, according to Beating AI reporting carried by BlockBeats on October 25.
The report said OpenAI paused frontier-model training and used AI agents to probe its systems after the incident.
Node.js confirms the vulnerability
The official Node.js security notice identifies the Brotli decoder issue as CVE-2026-111497, classifies it as high severity and credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer with reporting it.
The notice says malicious compressed input can corrupt process memory and potentially lead to remote code execution. It lists Node.js 26.x, 24.x and 22.x as affected. See the October 21 Node.js security advisory for the official details.
Source: BlockBeats, 2026-10-25 04:56:46 UTC.