OpenAI’s Security Findings Reach .NET Through Emergency Brotli Updates

Microsoft released an emergency update to its .NET software platform on October 25 for a flaw in Brotli, a widely used compression library. The fix reaches several generations of .NET, but installing it on a server can leave applications running an older decoder bundled inside their own files.

The same vulnerability, CVE-2026-111497, prompted Node.js updates four days earlier. Node.js credits OpenAI Codex Security researchers Khai Tran and Sylvie Mayer for reporting it. A decoder turns compressed data back into usable information; malformed input could make this one overwrite memory, potentially allowing a crash, disclosure of data or remote code execution.

The updates reveal a practical part of OpenAI’s expanding security work: reaching the copies of vulnerable software that other companies actually run. Its October 23 account of stronger training defenses described teams of AI agents finding weaknesses and engineers reproducing findings and verifying fixes. It said frontier reinforcement-learning training had resumed on October 1.

OpenAI’s containment report does not identify Brotli as a component involved in those sandbox escapes. The documented connection is its security team’s credited vulnerability report. Separately, its October 21 disclosure proposal says a response must continue through distributor updates, public guidance and deployment support.

A source-code repair still needs a release

Google’s repair changes how the decoder reports an invalid compressed stream. The old function returned a simple success-or-failure value; the replacement returns a specific error code and passes it through several decoding functions. The patch also changes the public header describing decoder errors.

The patch carries an author date of February 27, 2026. Brotli’s 1.2.1 security release is dated October 21. Those records identify different milestones: writing a repair and distributing a numbered release containing it. They do not establish when every downstream developer learned the security implications or incorporated the code.

Node.js describes why rejecting the malformed data matters. Its streaming decoder treated an invalid block switch as a temporary shortage of input, then continued adding bytes to an eight-byte buffer. Applications become exposed when they use the affected decoder on data an attacker can supply. A program that merely carries the library is not necessarily processing such input.

The application can carry its own vulnerable copy

Microsoft lists .NET 8.0.33, 9.0.22 and 10.0.14 among its updated runtimes, the software that runs an application. It distinguishes programs using a machine’s shared runtime from self-contained apps. The latter need rebuilding and republication; containers need rebuilding and redeployment from updated images.

Exposure also depends on configuration. Microsoft says ASP.NET Core request decompression and HttpClient automatic response decompression are disabled by default. Applications are affected when they enable Brotli handling or explicitly decode attacker-controlled data. Its older .NET Framework is unaffected.

Microsoft’s support policy, updated October 25, sets November 10 as the end of support for .NET 8 and .NET 9. That is 15 calendar days after October 26, by calculation. It lists .NET 10 support through November 14, 2028. Installing a security patch on the older releases does not extend their published support dates.

Java developers face a related packaging issue in Brotli4j. Its October 24 advisory says releases through 1.23.0 include vulnerable native decoder code. Updating the operating system’s Brotli library leaves that bundled copy in place. Version 1.24.0 updates the library, and the maintainer instructs users to update both Brotli4j and the platform-specific native packages they distribute.

That distinction explains why a language name cannot settle exposure. Brotli4j loads decoder code written in C through Java’s native interface. Java’s normal memory protections do not govern that decoder’s operations. The maintainer identifies untrusted compressed files and HTTP data as possible entry points, while stating that the encoder, which compresses data, is unaffected.

The Python Packaging Authority’s advisory database traces another copy to the PyPI Brotli package. It records 1.2.1 as the fixed version. With the package installed, widely used HTTP clients can decompress Brotli responses automatically, including requests through urllib3, httpx with its Brotli option and aiohttp. A developer assessing exposure therefore needs to identify the Python package and the data it handles.

A separate entry covers brotlicffi, another Python interface to the C decoder. It lists 1.2.1.0 as the fixed package version and includes 1.2.0.2 among affected releases. Both advisories point to Google’s decoder repair. A Python application can consequently need differently numbered updates depending on which interface its software uses.

Proxies and software scanners need separate updates

Envoy, software that manages network traffic between services, published its own advisory on October 23. It identifies deployments with Brotli decompression configured as affected. Fixes span five release branches, including 1.39.3 and 1.38.6. The advisory credits OpenAI Security Research. Operators using Envoy receive the repair through an Envoy update, not by changing a Node.js application elsewhere.

A software-inventory tool offers a documented example of a repair failing to reach every distributed copy. The cdxgen project’s advisory says its 12.8.8 release was intended to include the Node.js security update, but its standalone executables still bundled Node.js 24.18.0 and its container images were not published. The project directs users to later fixed packages.

The ordinary npm package uses the host’s Node.js, so updating that runtime can address the issue. Standalone executables and container images carry their own runtime. The advisory identifies compressed responses downloaded while scanning an untrusted repository, and compressed requests to server mode, as paths to the vulnerable decoder.

To distinguish those copies, cdxgen’s maintainer tells users to inspect the runtime reported by the executable or its post-build software inventory. The advisory names a Node.js package identifier in those records. Its repair list also changes the secure container image’s base: it had pointed at an August build, even under newer version tags.

OpenAI’s proposed response process explicitly asks maintainers to involve distributors and service providers before disclosure when they need time to prepare protection. After publication, it calls for guidance that lets operators identify exposure, locate updates and verify that repaired software is running. It also seeks feedback on fixing downstream packages while upstream updates remain pending.

The company is seeking feedback on how long defenders need before disclosure, which organizations should receive early warning and how to prepare reliable downstream packages when an upstream update is delayed. Maintainers would decide who receives advance information; OpenAI is asking independent experts to challenge the approach.