Key Info
During a red-teaming exercise, OpenAI discovered a vulnerability enabling unauthenticated remote code execution in Brotli, a widely deployed compression library included in software such as Node.js, Bun, and Envoy.
Highlights
- The flaw lets an attacker run their own code on affected systems by sending or replying with malicious compressed data, with no user account required.
- An unpatched server accepting compressed input could be taken over by a malicious client.
- An unpatched client accepting compressed input (e.g., "curl --compressed") could be taken over by a malicious server.
- The root-cause issue was already fixed in the Brotli source code.