OpenAI’s open-source security initiative has put out a standalone resource page for CVE-2026-111497, the critical Brotli decoder flaw that forced Node.js into an emergency patch cycle earlier this week, consolidating which software is affected, which releases carry the fix, and how teams can temporarily turn off Brotli decoding if they can’t patch right away.
The page, published under patchtheplanet.org, is the work of Patch the Planet, a Daybreak initiative OpenAI runs together with the security firm Trail of Bits. Rather than breaking new ground on the vulnerability itself, it functions as a running reference for maintainers and ops teams trying to figure out whether their stack is exposed, a useful one-stop addition at a moment when the bug has already spread well beyond Node.js into the dozens of tools and platforms built on top of it.
A Quick Recap Of The Bug
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, the compression library bundled into Node.js and used across huge swathes of the web to shrink HTTP traffic. Node.js shipped fixes for it on October 21 across its 22.x, 24.x and 26.x lines, alongside nine other security fixes, after researchers showed the flaw could be triggered simply by feeding a Node process attacker-controlled compressed data, whether in a request body or a fetched response, and used to leak memory or achieve full remote code execution.
Because Brotli decoding happens quietly in the background of so much server-side code, the blast radius has turned out to be large. Downstream projects ranging from workflow platform Trigger.dev to webmail servers and developer tooling like qlty have all pushed their own patches simply to pull in the fixed Node.js runtime, and Vercel moved to shield customers with emergency firewall rules the same day the bug became public.
What Patch The Planet Actually Does
Patch the Planet isn’t a vulnerability hunting tool on its own, it’s the part of OpenAI’s Daybreak cybersecurity program aimed at the unglamorous back half of the process: once a flaw like this is public, getting maintainers and downstream projects from “a CVE exists” to “we’ve actually shipped the fix.” OpenAI pairs Trail of Bits security engineers, along with HackerOne and Calif for disclosure and triage work, directly with open-source maintainers, validating and deduplicating reports before they ever land in an inbox, then helping write and test patches.
The Brotli page fits that mandate: a single, kept-current place pointing to the fixed releases and a practical stopgap (disabling Brotli decoding) for anyone who can’t upgrade their Node.js version immediately.
Part Of A Brutal Month For Internet Infrastructure
The Brotli flaw hasn’t been an isolated event. It landed in the same week as PHP’s emergency patch for two critical flaws that leaked online before a fix was ready, a bug serious enough that Japan’s prime minister and the US FBI both put out public warnings about it, and exploit attempts against it jumped from the thousands into the millions within hours of disclosure, according to Cloudflare’s CEO. Around the same time, cloud platform Railway disclosed a breach that may have exposed customer secrets, and the Node.js patch itself arrived bundled with a root certificate update made necessary by India’s eMudhra certificate authority compromise, a mess that’s since wiped out roughly ₹1,450 crore of the company’s market value.
It’s a stretch severe enough that it’s being described in dramatic terms by people who’d know. In the recent flurry of incidents, Salesforce CEO Marc Benioff and Shopify CEO Tobi Lutke both called the moment out publicly, with Lutke going as far as calling it one of the worst days for cybersecurity in a long time. And going by the non-stop updates from organizations around the world, it looks unlikely that this could go on for a long time.