bun
v1.4.4Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
- Maintenance
- Active1547 commits in 3 months · bus factor 1
- License
- OtherUnknown
- Security
- 3 advisories3 high
- Supported versions
- 1 line supportednewest 1
96.7k stars · 5.3k forks · 9.8k open issues · last release 24 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 3 high. Check the patched version against the one you run.
- highGHSA-cf8x-9m69-3gg3Oct 24, 2026HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall
- Affected
- >= 1.3.14, < 1.4.4
- Patched in
- 1.4.4
- highCVE-2026-111497Oct 23, 2026Bundled brotli decoder has an out-of-bounds write (CVE-2026-111497)
- Affected
- >= 1.0.21, < 1.4.4
- Patched in
- 1.4.4
- highGHSA-26q8-h657-pf84Oct 23, 2026Bundled root certificates trust compromised eMudhra (emSign) intermediate CAs
- Affected
- < 1.4.4
- Patched in
- 1.4.4