HighGHSA-26q8-h657-pf8423 Oct · 1 days ago
Source ↗

Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs.

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

23 Oct
13 hfrom publication to Patchwire
  1. Published by GitHub advisory23 Oct
  2. Seen by Patchwire23 Oct
  3. Fix released23 Oct
bun1.4.4

Versions of bun

1.x
safe 1.4.4
AffectedSafe

Packages

bun

Stacks

Bun

Related alerts(1)

Same packages

Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497)

bun · 23 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
  • The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
  • The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.
Affected
bun >=1.0.21 <1.4.4
Fixed in
1.4.4
ID
GHSA-663w-cv8g-jj2p
Open the alert