Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request

Code

Issues3.6k (3.6k)

Pull requests5k+ (5k+)

Discussions

Actions

Security and quality3 (3)

Insights

More items

bun

Security

Advisories

GHSA-cf8x-9m69-3gg3

HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall

High

alii published GHSA-cf8x-9m69-3gg3 Oct 24, 2026

Package

npm

bun (npm)

Affected versions

= 1.3.14, < 1.4.4

Patched versions

1.4.4

Description

Summary

A remote, unauthenticated peer can exhaust memory or stall a Bun process that uses HTTP/3. A small request can decode to a very large set of headers, and Bun 1.4.3 and earlier do not limit the decoded size.

This is the "Header Accordions" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected.

QPACK is the header compression of HTTP/3. A peer can add one large entry to the dynamic table and then refer to that entry many times, with one byte for each reference. Each reference decodes to a full copy of the entry.

Bun.serve advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit. It checked only the size of each single header. It also did not limit the number of fields.

HTTP/1.1 and HTTP/2 are not affected by this bug.

Executables built with bun build --compile embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt.

Denial of service. No credentials are necessary. In our tests on Bun 1.4.3:

A handler does not need to read the headers. The work happens before Bun calls the handler.

Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it.

Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields (#46392).

This changes behavior for large headers over HTTP/3:

Do not enable http3 on a server that untrusted clients can reach, and do not use the HTTP/3 client of fetch with untrusted servers. HTTP/1.1 and HTTP/2 are not affected.