OpenAI's red-team agents found a remote code execution bug in Brotli; patch Node.js, Bun and Envoy

CVE-2026-111497 (CVSS 9.2) is an out-of-bounds write in the Brotli decoder, versions 1.0.3 to 1.2.0, that lets crafted compressed data take over a server that accepts it or a client like curl --compressed; OpenAI says its frontier-agent red-teaming turned it up. Update to Brotli 1.0.10, 1.1.1 or 1.2.1, Node.js 22.23.4, 24.22.1 or 26.12.1, Bun 1.4.4, or Python Brotli 1.2.1, and reject untrusted br input until you do (fixed-version list).