Ce mail provient de l'extérieur, restons vigilants ============================================================= ======== CERT-Renater Note d'Information No. 2026/VULN1074 _____________________________________________________________________ DATE : 26/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running bun (npm) versions prior to 1.4.4. ==================================================================== https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3 https://github.com/oven-sh/bun/security/advisories/GHSA-26q8-h657-pf84 _____________________________________________________________________ Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497) High alii published GHSA-663w-cv8g-jj2p Package bun (npm) Affected versions >= 1.0.21, < 1.4.4 Patched versions 1.4.4 Description Summary Bun bundles Google's brotli library. CVE-2026-111497 is an out-of-bounds write in the brotli decoder. The brotli project states that it permits remote code execution. Bun 1.4.3 and earlier bundle an affected version of brotli, and they decode brotli data from untrusted sources. Bun 1.4.4 updates brotli to 1.2.1, which contains the fix. This is a bug in the brotli library, not in Bun's own code. Other projects that bundle brotli are affected in the same way. Node.js published fixes on October 21, 2026. Details The bug is in the brotli decoder. Affected versions of brotli are 1.0.3 to 1.2.0, except the fixed releases 1.0.10 and 1.1.1. Bun 1.4.3 bundles brotli 1.2.0. These Bun APIs pass data to the decoder: fetch. It sends Accept-Encoding: gzip, deflate, br, zstd by default and decodes a response with Content-Encoding: br automatically. A server that an application connects to can therefore send data to the decoder. node:zlib, including brotliDecompress, brotliDecompressSync and createBrotliDecompress. DecompressionStream, with the brotli format. Executables built with bun build --compile embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt. Impact An attacker who can supply brotli data to an affected API can cause an out-of-bounds write in the Bun process. For fetch, this includes a malicious server, and an attacker in the network path of an unencrypted connection. The brotli project states that the bug permits remote code execution. We have not tested an attack against Bun, so we do not know how the impact in Bun compares with the impact in other software. Treat this as a remote code execution risk. Patches Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it. Bun 1.4.4 updates brotli from 1.2.0 to 1.2.1 (#46392). Invalid data now fails with the new decoder error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. Workarounds There is no process-wide workaround for affected versions. Pass decompress: false to fetch. Bun then does not send Accept-Encoding: br and does not decode the response. This applies only to that request. Do not pass untrusted data to the brotli APIs in node:zlib or to DecompressionStream with the brotli format. References #46392 brotli 1.2.1: https://github.com/google/brotli/releases/tag/v1.2.1 Node.js October 2026 security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases Severity High CVE ID CVE-2026-111497 Weaknesses Weakness CWE-787 _____________________________________________________________________ HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall High alii published GHSA-cf8x-9m69-3gg3 Package bun (npm) Affected versions >= 1.3.14, < 1.4.4 Patched versions 1.4.4 Description Summary A remote, unauthenticated peer can exhaust memory or stall a Bun process that uses HTTP/3. A small request can decode to a very large set of headers, and Bun 1.4.3 and earlier do not limit the decoded size. This is the "Header Accordions" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected. Bun 1.4.4 fixes the bug. Details QPACK is the header compression of HTTP/3. A peer can add one large entry to the dynamic table and then refer to that entry many times, with one byte for each reference. Each reference decodes to a full copy of the entry. Bun.serve advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit. It checked only the size of each single header. It also did not limit the number of fields. Affected: Bun.serve with http3: true. HTTP/3 is off by default. The HTTP/3 client of fetch. fetch uses HTTP/3 only when you ask for it, with fetch(url, { protocol: "http3" }) or the --experimental-http3-fetch flag. A malicious server can attack the client in the same way. HTTP/1.1 and HTTP/2 are not affected by this bug. Executables built with bun build --compile embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt. Impact Denial of service. No credentials are necessary. In our tests on Bun 1.4.3: About 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed. One request of about 20 KB stalled the server for more than a minute, and other requests were not answered during that time. A request of about 530 KB kept the server at 100% CPU, and it answered no other requests. A handler does not need to read the headers. The work happens before Bun calls the handler. Patches Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it. Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields (#46392). This changes behavior for large headers over HTTP/3: A Bun.serve request over the limit (16 KB by default, set with --max-http-header-size) gets a 431 response. A much larger request closes the connection. fetch over HTTP/3 rejects a response with more than 256 KB of headers. Workarounds Do not enable http3 on a server that untrusted clients can reach, and do not use the HTTP/3 client of fetch with untrusted servers. HTTP/1.1 and HTTP/2 are not affected. References https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers #46475 #46392 Severity High CVE ID No known CVE Weaknesses Weakness CWE-770 _____________________________________________________________________ Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs High alii published GHSA-26q8-h657-pf84 Package bun (npm) Affected versions < 1.4.4 Patched versions 1.4.4 Description Summary Bun's bundled root certificates included emSign ECC Root CA - G3. Eight eMudhra (emSign) intermediate CAs were revoked for key compromise in October 2026, and the six of them that issue TLS certificates chain to that root. Bun 1.4.3 and earlier accept certificates issued by those intermediates. The private keys have been independently recovered by multiple people and some have been disclosed publicly, so any attacker in the network path can impersonate any TLS server to Bun. Bun 1.4.4 removes the root from the bundle and rejects any certificate chain that contains one of the eight compromised public keys. This is a compromise of a certificate authority's keys, not a bug in Bun's certificate validation. Other projects that ship their own trust store were affected in the same way. Details Any TLS client connection that uses Bun's default trust store is affected. That includes fetch, bun install, bun add, bunx, node:https, node:tls, WebSocket, Bun.connect and fetch over HTTP/3. A TLS server that sets requestCert: true without a ca also verifies client certificates against the default trust store, so it is affected in the same way. Bun checks revocation only against a CRL passed in the crl option, so the CA's revocation of the intermediates does not protect affected versions by default. Executables built with bun build --compile embed the Bun runtime and its trust store. An executable built with an affected version stays affected until it is rebuilt. Impact An attacker in the network path can present a forged certificate that Bun accepts as valid for any hostname. They can then read and modify the traffic. For bun install and bunx this includes the packages that are downloaded. Patches Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it. Bun 1.4.4 has two changes: Three emSign roots are removed and the bundle is updated to NSS 3.131.1 (#46159, #46300). This removes emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3. emSign Root CA - G1 stays in the bundle, as it does in NSS 3.131.1. A chain that contains one of the eight compromised public keys fails with CERT_REVOKED (#46300). The check matches the key rather than the certificate, and it applies whichever root the chain ends at. It therefore also covers cross-signed copies of the intermediates, roots loaded from the system store, NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, SSL_CERT_DIR, and a ca option. It applies to TLS over TCP, the HTTP/3 client and node:quic, and to client certificates that a server verifies. fetch over HTTP/3 reports the failure as HTTP3HandshakeFailed. The list of keys is the one Node.js, Go and Chrome block. Workarounds There is no process-wide workaround for affected versions. --use-system-ca and NODE_USE_SYSTEM_CA=1 do not help. They add the system's certificates to the bundled ones and do not replace them. Updating the operating system's certificates does not help, for the same reason. Passing an explicit ca (or tls.ca) on a connection replaces the default trust store for that connection only. A list that leaves out the emSign roots protects that connection. bun install --cafile (or --ca) does the same for thato install. bunx does not accept those flags before 1.4.4. cafile under [install] in bunfig.toml does the same for bun install. In ~/.bunfig.toml it also applies to bunx. References #46159 #46300 #46526 Mozilla incident report: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 uv: GHSA-hq85-5cpj-mr62 certifi: GHSA-6q48-6c7w-9gw2 Go: CVE-2026-111943 Rust: https://rustsec.org/advisories/RUSTSEC-2026-0381.html, https://rustsec.org/advisories/RUSTSEC-2026-0382.html, https://rustsec.org/advisories/RUSTSEC-2026-0383.html Severity High CVE ID No known CVE Weaknesses Weakness CWE-295 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================