HighGHSA-663w-cv8g-jj2pCVE-2026-11149723 Oct · today
Source ↗

Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497).

Does it affect you?

0/3All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisorynodejs.org

Timeline

23 Oct
6 hfrom publication to Patchwire
  1. Published by GitHub advisory23 Oct
  2. Seen by Patchwire23 Oct
  3. Fix released23 Oct
bun1.4.4

Versions of bun

1.x
safe 1.4.4
AffectedSafe

Packages

bun

Stacks

Bun

Related alerts(1)

Same packages

Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs

bun · 23 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
  • Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
  • No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
  • An attacker is positioned in the network path between the Bun process and the server.
Affected
bun <1.4.4
Fixed in
1.4.4
ID
GHSA-26q8-h657-pf84
Open the alert