HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall.

HighGHSA-cf8x-9m69-3gg324 Oct · today
Source

Does it affect you?

0/2All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

24 Oct
49 minfrom publication to Patchwire
  1. Published by GitHub advisory24 Oct
  2. Seen by Patchwire24 Oct
  3. Fix released24 Oct
bun1.4.4

Versions of bun

1.x
safe 1.4.4
AffectedSafe

Packages

bun

Stacks

Bun

Related alerts(2)

Same packages

Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497)

bun · 23 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
  • The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
  • The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.
Affected
bun >=1.0.21 <1.4.4
Fixed in
1.4.4
ID
GHSA-663w-cv8g-jj2p
Open the alert

Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs

bun · 23 Oct

High
Exploitable only if · read by Claude, the source remains the reference
  • Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
  • Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
  • No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
  • An attacker is positioned in the network path between the Bun process and the server.
Affected
bun <1.4.4
Fixed in
1.4.4
ID
GHSA-26q8-h657-pf84
Open the alert