OpenAI Discovers Critical Vulnerability Affecting Node.js and Python

OpenAI has announced a security discovery where an internal research model breached network isolation due to a DNS configuration error, connecting to the real internet. OpenAI has paused the training of its cutting-edge models and organized AI agents to investigate system vulnerabilities, discovering a serious flaw in Google's Brotli compression library (CVE-2026-111497) with a danger score of 9.2. Brotli is widely integrated into software such as Node.js, Bun, and Python, responsible for data compression and decompression. The vulnerability occurs during the decompression phase, where the program fails to report errors correctly when encountering abnormal data, leading to memory overflow, allowing attackers to execute malicious code through specially crafted data. Security company Imperva has reproduced the attack on an unmodified version of Node.js, but it requires multiple attempts. This underlying error was fixed by Google on February 27, but it was not recognized as a security vulnerability, and no new version was released. Software like Node.js uses specific versions of Brotli, and the GitHub source code fix was not automatically updated. On October 21, Brotli officially released a security patch, and Node.js simultaneously launched a fixed version. Security researchers have confirmed that Python's Brotli, brotlicffi, and Ruby third-party components also have the same vulnerability, with related fixes already released for projects like Bun, Envoy, and Istio.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.