Bun: fix available. Version unknown.
Last 30 days
2No criticalFix available
Safe versions
1.x1.4.4
Your project
bun is not in your saved lockfile.
Alerts(2)
Sorted by severityExploitable only if · read by Claude, the source remains the reference
- Project runs on Bun 1.4.3 or earlier (or ships a bun build --compile executable built with such a version).
- The bundled brotli version is affected (1.0.3 to 1.2.0, excluding 1.0.10 and 1.1.1).
- The application passes attacker-supplied brotli data to the decoder via fetch (with default decompression, from a malicious server or over an unencrypted connection), node:zlib brotli decompress APIs, or DecompressionStream with the brotli format.
- Affected
- bun >=1.0.21 <1.4.4
- Fixed in
- 1.4.4
- ID
- GHSA-663w-cv8g-jj2p
Exploitable only if · read by Claude, the source remains the reference
- Project runs Bun 1.4.3 or earlier, or ships a bun build --compile executable built with such a version.
- Project makes TLS client connections (fetch, bun install, bunx, node:https, node:tls, WebSocket, Bun.connect, HTTP/3 fetch) using Bun's default trust store, or runs a TLS server with requestCert: true and no ca option.
- No explicit ca / cafile excluding the emSign roots is configured for the affected connection or install.
- An attacker is positioned in the network path between the Bun process and the server.
- Affected
- bun <1.4.4
- Fixed in
- 1.4.4
- ID
- GHSA-26q8-h657-pf84
Packages
1Follow Bun
All read/feeds/stacks/bun.json