GHSA-54x7-74r2: Bun Node.js Brotli Stream Compatibility Port
Bun’s node:zlib Brotli decompression stream bindings shared the upstream boundary calculation issue addressed in CVE-2026-111497, allowing crafted Brotli streams to trigger out-of-bounds memory faults in Bun processes prior to v1.4.4.
Executive Summary & Technical Impact
Bun’s node:zlib Brotli decompression stream bindings shared the upstream boundary calculation issue addressed in CVE-2026-111497, allowing crafted Brotli streams to trigger out-of-bounds memory faults in Bun processes prior to v1.4.4.
Tracked under GHSA-54x7-74r2 (CWE-787 (Out-of-bounds Write)), this vulnerability affects Bun < v1.4.4 and carries a severity score of 7.5 (HIGH). Engineering and security operations teams running Bun Runtime should prioritize upgrading to Bun v1.4.4.
Remediation & Patch Guidance
- Upgrade Bun to v1.4.4 or newer across all server and build environments.
Frequently Asked Questions (GHSA-54x7-74r2)
What versions are affected by GHSA-54x7-74r2?
GHSA-54x7-74r2 affects Bun < v1.4.4 in Bun Runtime (Bun Node.js Brotli Stream Compatibility Port).
How do I patch or remediate GHSA-54x7-74r2?
Upgrade affected deployments to Bun v1.4.4 and verify the remediation steps listed above.
What is the CVSS score of GHSA-54x7-74r2?
GHSA-54x7-74r2 is rated HIGH with a CVSS score of 7.5 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
