Home / Security

Security

Using AI agents? You’re at risk: the prompt that keeps you safe

Many AI agents, Claude Code included, run on Node.js or Bun. A specially crafted compressed page can crash them and might let someone run commands on your computer. I’ll show you how to find every copy and update it.

Danilo Giudice · October 30, 2026

Type

Security: what is happening and what to do right now

Time

9 min read

Level

Beginner

What you’ll get

• Find out whether your computer is exposed
• The versions to install right away
• A prompt that runs the check for you

Backstory

What to do right now

If you use AI agents, you’re at risk.

In short: if you use AI agents, or a tool like Claude Code that browses the web, you’re exposed to a flaw. It can crash your programs and might let someone run commands on your PC.

Websites compress their pages so they are smaller to send, a bit like a ZIP file. One of the most common formats is Brotli, created by Google. The library that decompresses it had a flaw: a malformed compressed file made it write outside the memory space it was given. The flaw is in every version released from 2018 until the fix on October 21, and Google rated it 9.2 out of 10 for severity.

That library is built into Node.js and Bun, the programs that many AI agents and developer tools run on. When an agent downloads a page compressed with Brotli, it decompresses the page automatically. Meanwhile, that same agent has access to your files, your terminal, and the keys to the services you use.

According to the official CVE record, an attacker can crash the program, read its memory, and possibly run code. On that last point, as of October 22, researchers disagreed. But on October 27, CISA, the US cybersecurity agency, added the flaw to its catalog of known exploited vulnerabilities.

What to do

1. Update the AI agents and tools you use. The native version of Claude Code updates itself. Run claude --version to check that you have at least 2.1.308, the first version on my Mac that contains the fix.
2. Count your copies of Node. In the Terminal, which -a node lists them all (on Windows: where node). Each one must be fixed for its own release line: 22.23.4 or later on Node 22, 24.22.1 or later on Node 24, or 26.12.1 or later on Node 26. Bun must be at least 1.4.4.
3. Update the old ones the same way you installed them: Homebrew (brew upgrade node bun), nvm, or the installer from nodejs.org. Versions 25, 23, 21, 20, and older have no fix: move to one of the three fixed versions.
4. If you don’t want to do it by hand, let the agent do it. The prompt at the end checks everything and asks for your OK before each update.
5. Don’t download code from GitHub that promises to demonstrate the attack. You don’t know what else it does on your computer.

If you’ve never installed developer tools or AI agents, you probably don’t have Node. Keep your system and apps up to date anyway.

Where the flaw is and who it affects

Let’s get to the point. The flaw is called CVE-2026-111497. A CVE is the code that identifies a vulnerability in the public registry. Google assigned this one. On the CVSS 4.0 severity scale, it scores 9.2 out of 10. Node.js uses its own scale and rates it as high.

Node.js and Bun are runtimes: programs that run JavaScript code outside the browser. When an agent running on top of them needs to read a web page, it uses fetch(), the function that downloads a web address.

If the server replies with the header Content-Encoding: br, which means “this response is compressed with Brotli,” fetch() decompresses it automatically. It does this with the decoder, the part of the Brotli library that handles decompression. Node.js and Bun both include a copy of it.

That’s where the flaw is.

According to the Node.js advisory, an invalid block switch (a command in the compressed stream that changes the block type) was treated as data that hadn’t arrived yet, not as a format error. So the decoder kept adding bytes to an eight-byte internal buffer, which is a fixed-size slot in memory, and wrote past its end. This is called an out-of-bounds write.

The same path exists for servers. Express 5 and body-parser 2, two popular libraries for writing servers in Node.js, automatically decompress incoming Brotli-compressed data (Aikido). This also applies to untrusted data passed to node:zlib, the Node.js compression module, and, in Bun, to DecompressionStream("brotli") (issue #46352). And the library isn’t only in Node.js and Bun. According to Tenable, cited by Help Net Security, the projects that may be affected also include .NET, Envoy, and Python’s HTTP clients.

For an agent, the math is simple. It runs fetch() on web addresses you don’t control and passes every response to the decoder, inside a process that already has access to a shell (the terminal), your files, and your service keys.

The path

From a web page to the agent’s memory

In Node.js and Bun, fetch() automatically decompresses every Brotli response.

Web page

Content-Encoding: br

HTTP response

fetch()

decompresses automatically

compressed data

Brotli decoder

invalid block switch

out-of-bounds write

Corrupted memory

with shell and file access

Sources: Node.js advisory and CVE record, October 2026

There’s more than one runtime

The trouble is that the same computer often has more than one runtime. The native version of Claude Code contains its own Bun. Other agents install their own Node. Updating the system Node doesn’t touch the copies built into your tools, and updating Claude Code doesn’t touch the system Node. npm audit doesn’t help either: it checks a project’s packages, not the runtime binary.

On my Mac, which -a node found three copies of Node, all vulnerable: 22.22.3 from Hermes Agent, first in the PATH; 24.12.0 from the official installer; and 26.4.0 from Homebrew. The PATH is the list of folders where the system looks for programs, and the first match is the one that runs. There was also Bun 1.3.14, just to complete the collection. On October 27, all of them were up to date: Node 22.23.4, 24.22.1, and 26.12.1, and Bun 1.4.4.

Linux has one extra step. On Debian and Ubuntu, the Node you get from the package manager uses the system’s brotli library, so you also need to update the brotli package. As of October 23, Debian still listed it as unfixed. According to the CVE record, the fixed versions of the library are 1.0.10, 1.1.1, and 1.2.1, released on October 21.

The versions you need

• Node.js 22.23.4, 24.22.1, or 26.12.1, from October 21. The same advisory fixes 9 other vulnerabilities, 3 of them rated high like this one. Release lines 25, 23, 21, 20, and older don’t get the fix.
• Bun 1.4.4, from October 22.
• Claude Code 2.1.308, native version. If you installed it with Homebrew, WinGet, apt, dnf, or apk, you have to update it by hand, because automatic updates are off by default there.

The minimum Claude Code version doesn’t come from Anthropic. The changelog doesn’t mention Brotli, and for 2.1.308 it only says “Bug fixes and reliability improvements.” I worked it out from the binaries on my Mac. The name of the new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, is missing from 2.1.304 and 2.1.306 and appears from 2.1.308 on. The string “Bun v1.4.4,” on the other hand, is already in 2.1.304, so it proves nothing.

Code execution: from disputed to exploited

Code execution is the most serious part. For a few days, the sources disagreed about it. The CVE record says the flaw lets an attacker “potentially execute arbitrary code.” The Node.js advisory puts it right in the title: “permits remote code execution.”

As of October 22, the demo code on GitHub (a proof of concept, or PoC) didn’t settle the question. According to Aikido, the first one ran code only on a test build that had been deliberately weakened. The same day, Ron Masas of Imperva said on X that he had run code on an Express 5 server. Imperva’s test ran on the official Node.js 24.22.0 image for Linux arm64, and it didn’t succeed on every attempt. Real-world attacks reported as of that date: none.

Then things changed. According to Help Net Security, ELLIO, a company that monitors attack traffic, recorded real attack traffic that used the public PoC. ELLIO says that PoC opens a shell on vulnerable versions. On October 27, CISA added the flaw to its catalog. The CVE record, meanwhile, still says “potentially.”

So who found it? According to the Node.js advisory, it was OpenAI Codex Security, with Khai Tran and Sylvie Mayer. And there’s one fact that doesn’t depend on any demo: the fix in the Brotli code has been public since February 27, 236 days before the Node.js release.

Key dates

Fixed in February, released in Node.js 236 days later

2018 March 2: Brotli 1.0.3, first affected version

2026 February 27: fix published in Brotli’s code

2026 October 21: Node.js 22.23.4, 24.22.1, 26.12.1

2026 October 22: Bun 1.4.4

2026 October 27: CISA lists it as already exploited

MarFebOct201820192020202120222023202420252026

Sources: Brotli, Node.js, Bun, CISA

The prompt

Paste it into a new session with your agent, for example Claude Code. The agent lists every runtime, then proposes the updates and waits for your OK before each one. It does not uninstall or delete anything.

But these rules are just text, and text only changes the odds. It doesn’t guarantee a result. Read every command before you say yes. For Docker, the prompt lists the commands to rebuild your images, but rebuilding them is up to you, because restarting the old container isn’t enough.

You are a technical assistant. Your task is to check this machine and secure it against CVE-2026-111497 (an out-of-bounds write in Google’s Brotli decoder, which is included in Node.js and Bun) and against the other 9 vulnerabilities in the Node.js security release of October 21, 2026.
Run the steps in order, record every output, and summarize the final state. Before each update, show the command and wait for my OK.

1. Full inventory
• Show: node -v, which -a node (on Windows: where node) and the version of every node found; bun -v and which -a bun; claude --version and claude doctor
• Look for other runtimes: Node/Bun installs managed by nvm, fnm, asdf, Volta, or similar
• Identify the AI tools and agents on this machine (Claude Code, Cursor, Codex, Aider, Open Interpreter, Continue, Hermes Agent, etc.) and check whether they use a bundled runtime: look for folders that contain their own node or bun
• Look for single-file executables (Node SEA, bun build --compile): they bundle the runtime and must be recompiled
• Check the Docker images: docker images | grep -E 'node|bun'
• On Linux, check the version of the system brotli package: on Debian and Ubuntu, Node uses it

2. Node.js update
• Bring the system Node and every managed install to the fixed versions: ≥ 22.23.4 on line 22, ≥ 24.22.1 on line 24, ≥ 26.12.1 on line 26
• Release lines 25, 23, 21, 20, and older don’t get the fix: propose a migration to a supported line
• Use the method that matches how each one was installed (nvm, Homebrew, NodeSource, winget, official installer)
• Restart any running Node processes

3. Bun and Claude Code update
• Update Bun to ≥ 1.4.4 (bun upgrade, or brew upgrade bun if it comes from Homebrew)
• Claude Code must be ≥ 2.1.308. Native install: claude update. npm: npm install -g @anthropic-ai/claude-code@latest. Homebrew: brew upgrade claude-code (or claude-code@latest). WinGet: winget upgrade Anthropic.ClaudeCode. apt, dnf, apk: update the claude-code package
• Update the other AI tools that bundle their own runtime, through their official channel

4. Docker and containerized environments
• Flag the images based on vulnerable versions
• Give the commands to update them: docker pull node:24 (or the tag in use), then docker build --pull and a new deploy. Restarting the old container is not enough

5. Packages and system
• Update the global package managers (npm, yarn, pnpm), if present
• Suggest updating the operating system (apt, brew, winget, Windows Update, macOS updates)
• Note: npm audit does not cover this bug, because it is in the runtime, not in the packages

6. Final check and recommendations
• Re-run the version checks on every runtime found
• Confirm that no vulnerable runtimes are still active
• List the manual actions that remain
• Suggest a minimum set of good practices: isolate agents when possible, don’t fetch untrusted content without checks, keep automatic updates on, don’t run PoCs found online

Do not run destructive operations: no uninstalls, no deletions. At the end, report a table (runtime, path, version before and after, status) and separate what you updated from what needs human action.

An agent is an exposed server

So what now? If your agent has shell access, treat it like an exposed server: it downloads content from web addresses you don’t control, inside a process that has your credentials. List every runtime, update them right away, and open untrusted pages only inside a sandbox, meaning an isolated environment.

I’ll repeat the rest of the week for you, parrot-fashion

I keep up with AI, so on Monday morning you know what to try and what to ignore, with sources you can check.

Your email

Email me on Mondays

Leave this field empty

One email every Monday morning, in Italian. Unsubscribe with one click. Privacy

Prefer Telegram? News and tutorials go up there, in Italian, as soon as they come out.

Notify me on Telegram