GHSA-cf8x-9m69-3gg3: 
JavaScript vulnerability analysis and mitigation

Summary

A remote, unauthenticated peer can exhaust memory or stall a Bun process that uses HTTP/3. A small request can decode to a very large set of headers, and Bun 1.4.3 and earlier do not limit the decoded size. This is the "Header Accordions" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected. Bun 1.4.4 fixes the bug.

Details

QPACK is the header compression of HTTP/3. A peer can add one large entry to the dynamic table and then refer to that entry many times, with one byte for each reference. Each reference decodes to a full copy of the entry. Bun.serve advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit. It checked only the size of each single header. It also did not limit the number of fields. Affected:

• Bun.serve with http3: true. HTTP/3 is off by default.
• The HTTP/3 client of fetch. fetch uses HTTP/3 only when you ask for it, with fetch(url, { protocol: "http3" }) or the --experimental-http3-fetch flag. A malicious server can attack the client in the same way. HTTP/1.1 and HTTP/2 are not affected by this bug. Executables built with bun build --compile embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt.

Impact

Denial of service. No credentials are necessary. In our tests on Bun 1.4.3:

• About 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed.
• One request of about 20 KB stalled the server for more than a minute, and other requests were not answered during that time.
• A request of about 530 KB kept the server at 100% CPU, and it answered no other requests. A handler does not need to read the headers. The work happens before Bun calls the handler.

Patches

Upgrade to Bun 1.4.4, and rebuild any bun build --compile executables with it. Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields (#46392). This changes behavior for large headers over HTTP/3:

• A Bun.serve request over the limit (16 KB by default, set with --max-http-header-size) gets a 431 response.
• A much larger request closes the connection.
• fetch over HTTP/3 rejects a response with more than 256 KB of headers.

Workarounds

Do not enable http3 on a server that untrusted clients can reach, and do not use the HTTP/3 client of fetch with untrusted servers. HTTP/1.1 and HTTP/2 are not affected.

References

• https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
• https://github.com/oven-sh/bun/issues/46475
• https://github.com/oven-sh/bun/pull/46392