GHSA-26q8-h657-pf84: GHSA-26q8-h657-pf84 (Bun v1.4.4 Released)

Executive Summary & Technical Impact

Why upgrading to Bun 1.4.4 is essential to prevent HTTP/3 memory amplification, patch Brotli CVE-2026-111497, and rebuild standalone compiled binaries.

Tracked under GHSA-26q8-h657-pf84 (CWE-Other (Security Advisory)), this vulnerability affects Bun < 1.4.4 and carries a severity score of 9.2 (HIGH). Engineering and security operations teams running Bun Infrastructure should prioritize upgrading to Bun 1.4.4.

Remediation & Patch Guidance

1. GHSA-cf8x-9m69-3gg3 (CVSS 9.2 High): An HTTP/3 QPACK decompression amplification attack dubbed 'Header Accordions' allows a 20 KB payload to stall the CPU and 6 MB to exhaust 2 GB of RAM when http3: true is enabled.
2. Updates the bundled Brotli library to version 1.2.1 to remediate the critical CVE-2026-111497 out-of-bounds write flaw.
3. GHSA-26q8-h657-pf84: Removes 8 compromised eMudhra (emSign) intermediate Certificate Authority keys from Bun's built-in root trust store.
4. Developers distributing standalone executables via 'bun build --compile' must recompile their binaries using Bun v1.4.4.

Frequently Asked Questions (GHSA-26q8-h657-pf84)

What versions are affected by GHSA-26q8-h657-pf84?

GHSA-26q8-h657-pf84 affects Bun < 1.4.4 in Bun Infrastructure (GHSA-26q8-h657-pf84 (Bun v1.4.4 Released)).

How do I patch or remediate GHSA-26q8-h657-pf84?

Upgrade affected deployments to Bun 1.4.4 and verify the remediation steps listed above.

What is the CVSS score of GHSA-26q8-h657-pf84?

GHSA-26q8-h657-pf84 is rated HIGH with a CVSS score of 9.2 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).