Bun's HTTP/3 fix limits headers before they exhaust the server Bun 1.4.4 closes a remotely triggered denial of service in opt-in HTTP/3 servers and clients. Compiled applications need rebuilding too.