Bun released 1.4.4 to stop trusting compromised eMudhra certificate-authority keys. Its October 23 advisory lists all versions before 1.4.4 as affected. Standalone applications built with those versions retain the vulnerable runtime until rebuilt.

TLS, the protocol protecting encrypted connections, depends on certificates that authenticate the other endpoint. A compromised authority key can let someone impersonate a trusted server even when encryption remains enabled.

What the evidence establishes

Bun says eight eMudhra intermediate authorities were revoked for key compromise. Six could issue TLS certificates chaining to a root in Bun’s bundle. Multiple people recovered the private keys, and some keys became public.

Lawrence Abrams’s BleepingComputer reporting independently verified that one published key matched a revoked certificate. That demonstrates compromised signing material; it does not establish interception of Bun users’ traffic.

Exploitation status: compromised authority keys and a vendor-confirmed impersonation risk. The reviewed material reports no confirmed attacks against Bun installations. An attacker must be in the network path to present a forged certificate and read or change traffic.

Package downloads and embedded runtimes are exposed

The advisory covers connections using Bun’s default trust store, including fetch, HTTPS, WebSocket and package downloads through bun install, bun add and bunx. For package downloads, interception can change the software being delivered.

A Bun server requesting client certificates with requestCert: true, but without an explicit ca, also uses that default store. The exposure therefore includes some client-authentication setups.

Bun normally checks revocation only against a certificate-revocation list supplied through its crl option. Revoking the intermediates elsewhere did not automatically protect these connections.

Upgrade the runtime and the artifacts it produced

  • Upgrade to 1.4.4 or a later release containing the fix. Check development machines, build environments, deployment images and running services separately.
  • Rebuild and redeploy executables produced by bun build --compile. They embed their own runtime and trust store. Updating the Bun installation beside an old executable leaves that executable unchanged.
  • Do not rely on operating-system certificate updates alone. Bun’s --use-system-ca and NODE_USE_SYSTEM_CA=1 add certificates to its bundled set rather than replacing it.
  • Treat explicit certificate lists as connection-specific workarounds. The advisory describes lists excluding the affected roots for individual connections and package installation. It says there is no process-wide workaround for affected versions.

The fix removes three emSign roots and updates the bundle to NSS 3.131.1. It also rejects chains containing any of the eight compromised public keys, including cross-signed copies and chains using custom certificate sources.

The 1.4.4 release preceded the advisory by a day. Older coverage listing Bun’s fix as pending is superseded by that release and this advisory.

Bun maintains the affected runtime and supplies the exposure and remediation claims. The advisory has no assigned CVE; GHSA-26q8-h657-pf84 is its identifier.

Caveat: updating closes this trust failure; it cannot establish whether earlier traffic or package downloads were intercepted.