OpenAI Found a Brotli Flaw That Can Own Your Node.js Server
OpenAI Found a Brotli Flaw That Can Own Your Node.js Server By Daniel Rao | October 24, 2026 Here is a nightmare that started with a spell-checker's worst enemy: a file compressor. This week, OpenAI's red team — the people paid to break things — announced they had found a way to seize control of servers through Brotli, the humble compression library quietly bundled into Node.js, Bun, and Envoy. No password. No login. Just a carefully poisoned package of compressed data. It has a name already, because every serious bug apparently needs branding now: Node2Shell . And the twist that makes this story genuinely unnerving isn't the exploit itself. It's that the fix has been sitting in Brotli's source code since February . For eight months, everyone treated it as routine maintenance. Nobody thought to call it what it was: a skeleton key. We checked the CVE record, the Node.js advisory listing and Imperva's technical write-up end to end before writing this, and con...