{"id":"GHSA-cf8x-9m69-3gg3","kind":"vulnerability","aliases":["GHSA-cf8x-9m69-3gg3"],"related":[],"title":"HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall","description":"### Summary\n\nA remote, unauthenticated peer can exhaust memory or stall a Bun process that uses HTTP/3. A small request can decode to a very large set of headers, and Bun 1.4.3 and earlier do not limit the decoded size.\n\nThis is the \"Header Accordions\" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected.\n\nBun 1.4.4 fixes the bug.\n\n### Details\n\nQPACK is the header compression of HTTP/3. A peer can add one large entry to the dynamic table and then refer to that entry many times, with one byte for each reference. Each reference decodes to a full copy of the entry.\n\n`Bun.serve` advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit. It checked only the size of each single header. It also did not limit the number of fields.\n\nAffected:\n\n- `Bun.serve` with `http3: true`. HTTP/3 is off by default.\n- The HTTP/3 client of `fetch`. `fetch` uses HTTP/3 only when you ask for it, with `fetch(url, { protocol: \"http3\" })` or the `--experimental-http3-fetch` flag. A malicious server can attack the client in the same way.\n\nHTTP/1.1 and HTTP/2 are not affected by this bug.\n\nExecutables built with `bun build --compile` embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt.\n\n### Impact\n\nDenial of service. No credentials are necessary. In our tests on Bun 1.4.3:\n\n- About 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed.\n- One request of about 20 KB stalled the server for more than a minute, and other requests were not answered during that time.\n- A request of about 530 KB kept the server at 100% CPU, and it answered no other requests.\n\nA handler does not need to read the headers. The work happens before Bun calls the handler.\n\n### Patches\n\nUpgrade to Bun 1.4.4, and rebuild any `bun build --compile` executables with it.\n\nBun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields (#46392).\n\nThis changes behavior for large headers over HTTP/3:\n\n- A `Bun.serve` request over the limit (16 KB by default, set with `--max-http-header-size`) gets a `431` response.\n- A much larger request closes the connection.\n- `fetch` over HTTP/3 rejects a response with more than 256 KB of headers.\n\n### Workarounds\n\nDo not enable `http3` on a server that untrusted clients can reach, and do not use the HTTP/3 client of `fetch` with untrusted servers. HTTP/1.1 and HTTP/2 are not affected.\n\n### References\n\n- https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers\n- https://github.com/oven-sh/bun/issues/46475\n- https://github.com/oven-sh/bun/pull/46392","summary":"Bun's HTTP/3 support does not limit the decoded size of request headers, so a small QPACK-compressed request can expand into a very large header set. A remote, unauthenticated attacker can exhaust memory or stall a Bun process that uses HTTP/3.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bun","fixed":["1.4.4"],"affected":">= 1.3.14, < 1.4.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["bun","cwe-770","http3","npm","package","self-hosted"],"not_affected_if":["http1-or-http2-only","http3-off","no-untrusted-clients"],"how_to_check":"- Run `bun --version` and check whether it is below `1.4.4`.\n- Search your code and config for `http3: true` in `Bun.serve` calls, and for `protocol: \"http3\"` or `--experimental-http3-fetch` in `fetch` use.\n- Check whether any `bun build --compile` executables were built with a version below `1.4.4`.","fix":"- Bun: upgrade to `1.4.4` and rebuild any `bun build --compile` executables with it.","status":"open","published_at":"2026-10-24T00:13:31+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","triaged_at":"2026-11-09T22:58:55+00:00","updated_at":"2026-11-09T22:58:55+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:58:55Z","model":"claude-haiku-5-5","output":{"fix":"- Bun: upgrade to `1.4.4` and rebuild any `bun build --compile` executables with it.","reach":"internet","title":"Bun: HTTP/3 header decoding lets a remote peer exhaust memory and stall","impact":"medium","summary":"Bun's HTTP/3 support does not limit the decoded size of request headers, so a small QPACK-compressed request can expand into a very large header set. A remote, unauthenticated attacker can exhaust memory or stall a Bun process that uses HTTP/3.","audience":"developers","category":"package","nicknames":["Header Accordions"],"who_cares":["bun","http3","self-hosted","npm"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Remote peer exhausts server memory or pins CPU, causing denial of service","analyst_note":"","how_to_check":"- Run `bun --version` and check whether it is below `1.4.4`.\n- Search your code and config for `http3: true` in `Bun.serve` calls, and for `protocol: \"http3\"` or `--experimental-http3-fetch` in `fetch` use.\n- Check whether any `bun build --compile` executables were built with a version below `1.4.4`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["http3-off","http1-or-http2-only","no-untrusted-clients"],"who_is_affected":"Only Bun processes using HTTP/3 are exposed: `Bun.serve` with `http3: true`, which is off by default, or the HTTP/3 client of `fetch` talking to untrusted servers. HTTP/1.1 and HTTP/2 are not affected. Compiled executables stay exposed until they are rebuilt with a fixed Bun.","user_interaction":"no","product_ecosystem":"npm","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00089,"input_tokens":5592,"output_tokens":661,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-770':24B '/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers':519C '/oven-sh/bun/issues/46475':522C '/oven-sh/bun/pull/46392':525C '1.4.3':104C,314C '1.4.4':137C,398C,409C '100':369C '16':189C,450C '2':325C '20':126C,340C '2026':127C '256':481C '3gg3':15A,20A '4.2.2':428C '431':463C '46392':435C '530':363C '6':316C '9114':426C '9m69':14A,19A 'accordion':117C 'add':152C 'advertis':185C 'affect':135C,222C,274C,293C,296C,515C 'allow':4A 'also':214C 'amplif':3A,119C 'answer':355C,373C 'ask':243C 'attack':62B,120C,262C 'behavior':438C 'bug':140C,277C 'build':282C,403C 'built':279C,290C 'bun':21A,22B,31B,69B,85C,103C,133C,136C,281C,286C,313C,390C,397C,402C,408C 'bun.serve':184C,223C,445C 'byte':170C 'call':391C 'cf8x':13A,18A 'chang':437C 'check':205C 'client':234C,264C,495C,504C 'close':469C 'compil':283C,404C 'compress':49B,146C 'connect':471C 'copi':180C 'count':422C 'cpu':9A,370C 'credenti':306C 'cwe':23B 'decod':39B,94C,111C,176C,415C 'default':231C,453C 'denial':302C 'detail':141C 'dynam':158C 'earlier':106C 'emb':284C 'enabl':488C 'enforc':201C,410C 'entri':155C,165C,183C 'execut':278C,289C,405C 'exhaust':7A,64B,80C 'expand':52B 'experiment':254C 'experimental-http3-fetch':253C 'fetch':236C,237C,247C,256C,472C,506C 'field':221C,434C 'fix':138C 'flag':257C 'foxio':122C 'foxio.io':518C 'foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers':517C 'full':179C 'gb':326C 'get':334C,461C 'ghsa':12A,17A 'ghsa-cf8x-9m69-3gg3':11A,16A 'github.com':521C,524C 'github.com/oven-sh/bun/issues/46475':520C 'github.com/oven-sh/bun/pull/46392':523C 'handler':378C,393C 'happen':388C 'header':43B,57B,101C,116C,145C,196C,212C,385C,421C,441C,459C,484C 'host':30B 'http':458C 'http/1.1':269C,510C 'http/2':271C,512C 'http/3':1A,33B,73B,89C,148C,227C,233C,239C,443C,474C,503C 'http3':25B,225C,250C,255C,489C 'impact':301C 'kb':190C,341C,364C,451C,482C 'kept':365C 'kill':335C 'larg':56B,98C,154C,440C 'larger':467C 'limit':37B,109C,187C,203C,217C,328C,412C,430C,449C 'list':132C 'made':320C 'malici':259C 'mani':166C 'max':457C 'max-http-header-s':456C 'mb':317C 'memori':6A,65B,81C,327C,332C 'minut':349C 'much':466C 'necessari':308C 'need':381C 'npm':26B 'number':219C,432C 'octob':125C 'one':153C,169C,336C 'packag':27B 'patch':394C 'peer':78C,150C 'process':70B,86C 'protocol':249C 'publish':123C 'qpack':2A,48B,118C,142C 'qpack-compress':47B 'reach':497C 'read':383C 'rebuild':400C 'rebuilt':300C 'refer':162C,173C,175C,516C 'reject':475C 'remot':5A,60B,76C 'request':42B,50B,92C,195C,337C,352C,360C,376C,446C,468C 'respons':464C,477C 'rfc':425C 'run':329C 'runtim':287C 'section':427C 'self':29B 'self-host':28B 'server':260C,322C,344C,367C,492C,509C 'servic':304C 'set':58B,99C,193C,419C,454C 'singl':211C 'size':40B,112C,208C,416C,460C 'small':46B,91C 'stall':10A,67B,83C,342C 'stay':295C 'summari':74C 'support':34B 'tabl':159C 'test':311C 'time':167C,358C 'traffic':319C 'true':226C 'unauthent':61B,77C 'untrust':494C,508C 'upgrad':395C 'url':248C 'use':72B,88C,238C,501C 'version':294C 'way':268C 'work':387C 'workaround':485C 'write':130C 'write-up':129C","nicknames":["Header Accordions"],"mitigations":[],"who_affected":"Only Bun processes using HTTP/3 are exposed: `Bun.serve` with `http3: true`, which is off by default, or the HTTP/3 client of `fetch` talking to untrusted servers. HTTP/1.1 and HTTP/2 are not affected. Compiled executables stay exposed until they are rebuilt with a fixed Bun.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["bun","headeraccordions"],"ptokens":["bun"],"labels":["bun","cwe770","high","http3","npm","package","selfhosted"],"campaign_type":null,"search_a":"'3gg3':15A,20A '9m69':14A,19A 'allow':4A 'amplif':3A 'bun':21A 'cf8x':13A,18A 'cpu':9A 'exhaust':7A 'ghsa':12A,17A 'ghsa-cf8x-9m69-3gg3':11A,16A 'http/3':1A 'memori':6A 'qpack':2A 'remot':5A 'stall':10A","search_b":"'-770':24B 'attack':62B 'bun':22B,31B,69B 'compress':49B 'cwe':23B 'decod':39B 'exhaust':64B 'expand':52B 'header':43B,57B 'host':30B 'http/3':33B,73B 'http3':25B 'larg':56B 'limit':37B 'memori':65B 'npm':26B 'packag':27B 'process':70B 'qpack':48B 'qpack-compress':47B 'remot':60B 'request':42B,50B 'self':29B 'self-host':28B 'set':58B 'size':40B 'small':46B 'stall':67B 'support':34B 'unauthent':61B 'use':72B","search_c":"'/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers':519C '/oven-sh/bun/issues/46475':522C '/oven-sh/bun/pull/46392':525C '1.4.3':104C,314C '1.4.4':137C,398C,409C '100':369C '16':189C,450C '2':325C '20':126C,340C '2026':127C '256':481C '4.2.2':428C '431':463C '46392':435C '530':363C '6':316C '9114':426C 'accordion':117C 'add':152C 'advertis':185C 'affect':135C,222C,274C,293C,296C,515C 'also':214C 'amplif':119C 'answer':355C,373C 'ask':243C 'attack':120C,262C 'behavior':438C 'bug':140C,277C 'build':282C,403C 'built':279C,290C 'bun':85C,103C,133C,136C,281C,286C,313C,390C,397C,402C,408C 'bun.serve':184C,223C,445C 'byte':170C 'call':391C 'chang':437C 'check':205C 'client':234C,264C,495C,504C 'close':469C 'compil':283C,404C 'compress':146C 'connect':471C 'copi':180C 'count':422C 'cpu':370C 'credenti':306C 'decod':94C,111C,176C,415C 'default':231C,453C 'denial':302C 'detail':141C 'dynam':158C 'earlier':106C 'emb':284C 'enabl':488C 'enforc':201C,410C 'entri':155C,165C,183C 'execut':278C,289C,405C 'exhaust':80C 'experiment':254C 'experimental-http3-fetch':253C 'fetch':236C,237C,247C,256C,472C,506C 'field':221C,434C 'fix':138C 'flag':257C 'foxio':122C 'foxio.io':518C 'foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers':517C 'full':179C 'gb':326C 'get':334C,461C 'github.com':521C,524C 'github.com/oven-sh/bun/issues/46475':520C 'github.com/oven-sh/bun/pull/46392':523C 'handler':378C,393C 'happen':388C 'header':101C,116C,145C,196C,212C,385C,421C,441C,459C,484C 'http':458C 'http/1.1':269C,510C 'http/2':271C,512C 'http/3':89C,148C,227C,233C,239C,443C,474C,503C 'http3':225C,250C,255C,489C 'impact':301C 'kb':190C,341C,364C,451C,482C 'kept':365C 'kill':335C 'larg':98C,154C,440C 'larger':467C 'limit':109C,187C,203C,217C,328C,412C,430C,449C 'list':132C 'made':320C 'malici':259C 'mani':166C 'max':457C 'max-http-header-s':456C 'mb':317C 'memori':81C,327C,332C 'minut':349C 'much':466C 'necessari':308C 'need':381C 'number':219C,432C 'octob':125C 'one':153C,169C,336C 'patch':394C 'peer':78C,150C 'process':86C 'protocol':249C 'publish':123C 'qpack':118C,142C 'reach':497C 'read':383C 'rebuild':400C 'rebuilt':300C 'refer':162C,173C,175C,516C 'reject':475C 'remot':76C 'request':92C,195C,337C,352C,360C,376C,446C,468C 'respons':464C,477C 'rfc':425C 'run':329C 'runtim':287C 'section':427C 'server':260C,322C,344C,367C,492C,509C 'servic':304C 'set':99C,193C,419C,454C 'singl':211C 'size':112C,208C,416C,460C 'small':91C 'stall':83C,342C 'stay':295C 'summari':74C 'tabl':159C 'test':311C 'time':167C,358C 'traffic':319C 'true':226C 'unauthent':77C 'untrust':494C,508C 'upgrad':395C 'url':248C 'use':88C,238C,501C 'version':294C 'way':268C 'work':387C 'workaround':485C 'write':130C 'write-up':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-24T00:13:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-cf8x-9m69-3gg3","url":"https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3","severity":"high","published_at":"2026-10-24T00:13:31+00:00","modified_at":"2026-10-24T00:13:31+00:00","first_seen_at":"2026-11-09T22:53:15+00:00","fetched_at":"2026-11-09T22:53:15+00:00","note":null}],"documents":[{"id":2940,"url":"https://news.ycombinator.com/item?id=50224189","title":"Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request","kind":"post","source":"hackernews","publisher":null,"text":"Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request\nhttps://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-24T19:16:24+00:00","relation":"discussion","confidence":null,"note":null},{"id":110408,"url":"https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}