Bun security vulnerabilities
3 published Bun vulnerabilities, newest first. Updated 2026-10-31.
Release lines
| Line | Newest release | Released | End of life | |
|---|---|---|---|---|
| 1 | 1.4.4 | 2023-09-07 | not announced | Supported |
| Published | Severity | ID | Summary | Affected releases |
|---|---|---|---|---|
| 2026-10-24 | High | GHSA-cf8x-9m69-3gg3 | HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall | >=1.3.14 <1.4.4 |
| 2026-10-23 | High | CVE-2026-111497 | Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497) | >=1.0.21 <1.4.4 |
| 2026-10-23 | High | GHSA-26q8-h657-pf84 | Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs | <1.4.4 |
Vulnerabilities from the oven-sh/bun GitHub security advisories; lines from endoflife.date. Bun supports only its newest release.