OpenAI Codex Security researchers reported CVE-2026-111497, a Brotli decoder flaw that prompted patches for Node.js 22.x, 24.x and 26.x.