An unauthenticated flaw in Brotli can let attackers execute code on unpatched systems that handle malicious compressed input, putting both servers and clients at risk, OpenAI said.
An attacker does not need an account or other authentication. A server may be targeted with hostile compressed input, while a client may be compromised after accepting it from a malicious server.
Brotli ships with products such as Node.js, Bun and Envoy. The Node.js Project issued an Oct. 21 security advisory, and EconoTimes previously covered the Brotli flaw.
OpenAI said the underlying Brotli code was fixed in February, but the issue was not identified as a security vulnerability then. Downstream maintainers must incorporate the Brotli patch into their own releases before users of those products receive it.
