Bun publishes three security advisories, all fixed in Bun 1.4.4
Bun disclosed three security advisories affecting Bun 1.4.3 and earlier: compromised eMudhra certificates, a brotli decoder bug known as HTTP2Shell, and the HTTP/3 "Header Accordions" attack. All three are fixed in Bun 1.4.4. The team asks users to run `bun upgrade` and to rebuild anything made with `bun build --compile`.
Why it matters
Bun 1.4.3 and earlier have three security issues (certificates, a brotli out-of-bounds write, an HTTP/3 attack); 1.4.4 fixes them, so users should upgrade and rebuild bun build --compile output.
Sources2
@bunjavascriptOfficial · XWe published three security advisories for Bun 1.4.3 and earlier: compromised eMudhra certificates, the brotli decoder bug (HTTP2Shell), and the HTTP/3 "Header Accordions" attack.
These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile`
$ bun upgrade
https://github.com/oven-sh/bun/security/advisoriesView original · - GitHub · oven-sh/bunGitHubBundled brotli decoder has an out-of-bounds write (CVE-2026-111497)View original ·
Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.