What is the CVSS score and severity of GHSA-cf8x-9m69-3gg3?

GHSA-cf8x-9m69-3gg3 is rated HIGH with a CVSS score of 9.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) and is classified under CWE-400 (Uncontrolled Resource Consumption).

GHSA-cf8x-9m69-3gg3 HIGH · CVSS 9.2 · Oven — Bun Runtime · 2026-10-27

GHSA-cf8x-9m69-3gg3: Bun HTTP/3 QPACK Header Decoder

Q: What versions are affected by GHSA-cf8x-9m69-3gg3?

GHSA-cf8x-9m69-3gg3 affects Bun < v1.4.4 in Bun Runtime (Bun HTTP/3 QPACK Header Decoder).

Q: How do I patch or remediate GHSA-cf8x-9m69-3gg3?

To remediate GHSA-cf8x-9m69-3gg3, upgrade to the patched release: Bun v1.4.4. Run `bun upgrade` to update all production and CI environments to Bun v1.4.4 or newer. Note that Bun v1.4.4 also backports the critical Node.js Brotli stream fix (CVE-2026-111497) and updates the Mozilla root CA bundle.

A flaw in Bun’s HTTP/3 QPACK dynamic table decompression state machine allows remote attackers to trigger unbounded memory allocation or crash the Bun.serve HTTP/3 listener with a sequence of malformed QUIC header frames (tracked upstream as GHSA-cf8x-9m69 / GHSA-cf8x-9m69-3gg3).

Identifier

GHSA-cf8x-9m69-3gg3

Vendor / Product

Oven · Bun Runtime

Severity / CVSS

HIGH · CVSS 9.2

Vector / CWE

CWE-400 (Uncontrolled Resource Consumption)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected

Bun < v1.4.4

Patched Version

Bun v1.4.4

Priority

P1 — Upgrade Bun to v1.4.4+

Executive Summary & Technical Impact

Tracked under GHSA-cf8x-9m69-3gg3 (CWE-400 (Uncontrolled Resource Consumption)), this vulnerability affects Bun < v1.4.4 and carries a severity score of 9.2 (HIGH). Engineering and security operations teams running Bun Runtime should prioritize upgrading to Bun v1.4.4.

Remediation & Patch Guidance

Run `bun upgrade` to update all production and CI environments to Bun v1.4.4 or newer.
Note that Bun v1.4.4 also backports the critical Node.js Brotli stream fix (CVE-2026-111497) and updates the Mozilla root CA bundle.

Frequently Asked Questions (GHSA-cf8x-9m69-3gg3)

What versions are affected by GHSA-cf8x-9m69-3gg3?

GHSA-cf8x-9m69-3gg3 affects Bun < v1.4.4 in Bun Runtime (Bun HTTP/3 QPACK Header Decoder).

How do I patch or remediate GHSA-cf8x-9m69-3gg3?

Upgrade affected deployments to Bun v1.4.4 and verify the remediation steps listed above.

What is the CVSS score of GHSA-cf8x-9m69-3gg3?

GHSA-cf8x-9m69-3gg3 is rated HIGH with a CVSS score of 9.2 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).

Full TechPulse Investigation

Bun v1.4.4 Released: Fixing the 'Header Accordions' HTTP/3 QPACK DoS & eMudhra CA Revocation

Why upgrading to Bun 1.4.4 is essential to prevent HTTP/3 memory amplification, patch Brotli CVE-2026-111497, and rebuild standalone compiled binaries.

Read full engineering post-mortem (6 min read) →