Bun has fixed an HTTP/3 flaw that lets an unauthenticated peer exhaust memory or stall a process. Its October 24 advisory lists 1.3.14 ≤ version < 1.4.4 as affected. Bun 1.4.4 is the patched release.

The exposure requires explicitly enabled HTTP/3, the newer HTTP transport. Bun leaves it off by default. HTTP/1.1 and HTTP/2 are outside this advisory.

Both sides of an HTTP/3 connection can be exposed

  • Servers: Bun.serve with http3: true can receive the malicious input from untrusted clients.
  • Clients: fetch can receive it from a malicious server when HTTP/3 is explicitly requested through its protocol option or experimental flag.
  • Compiled applications: executables produced by bun build --compile contain their own Bun runtime. Updating the system’s Bun installation leaves those older executables affected until rebuilt.

The work happens before the request handler runs. An application need not read the headers for the server to suffer the denial of service.

A small encoded request became excessive work

QPACK, HTTP/3’s header compression, lets a short reference represent a much larger header. Bun checked individual header sizes but failed to enforce the advertised cumulative limit. It also lacked a field-count limit.

In the maintainer’s tests on Bun 1.4.3, roughly 6 MB of traffic exhausted a server’s 2 GB memory limit. A request of about 20 KB prevented other requests from being answered for more than a minute. These are controlled test results, not measurements of attacks against deployed services.

Sébastien Féry’s October 20 FoxIO research describes the broader Header Accordions problem across several implementations. It listed Bun as unpatched then. Bun’s newer advisory supersedes that status for 1.4.4.

Exploitation status: researcher and maintainer demonstrations. The reviewed sources do not establish exploitation in the wild. The Bun advisory assigns GHSA-cf8x-9m69-3gg3 and lists no known CVE.

Upgrade the runtime that actually handles traffic

Upgrade affected deployments to Bun 1.4.4 and rebuild compiled executables with the fixed runtime. Until then, Bun recommends disabling HTTP/3 on servers reachable by untrusted clients and avoiding HTTP/3 fetches to untrusted servers.

The fix limits the decoded header total and field count. Oversized server requests normally receive HTTP 431; much larger requests close the connection. HTTP/3 fetch rejects responses exceeding 256 KB of headers.

Bun 1.4.4 also addresses the separate compromised certificate-key issue. These are different flaws, but both require replacing embedded runtimes in compiled applications.

Caveat: Bun supplies the fix and its test figures; FoxIO develops security tooling and discovered the underlying issue. Neither source provides a reliable count of affected deployments.