bun has 2 advisories. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
1.x
safe 1.4.4
AffectedSafe
Details
- You run
- not in lockfile
- Safe
- 1.4.4
- Advisories
- 2 in 120 days
Alerts(2)
Exploitable only if · read by Claude, the source remains the reference
- Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
- The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
- The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.
- Affected
- bun >=1.0.21 <1.4.4
- Fixed in
- 1.4.4
- ID
- GHSA-663w-cv8g-jj2p
Exploitable only if · read by Claude, the source remains the reference
- Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
- Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
- No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
- An attacker is positioned in the network path between the Bun process and the server.
- Affected
- bun <1.4.4
- Fixed in
- 1.4.4
- ID
- GHSA-26q8-h657-pf84