---
id: "GHSA-cf8x-9m69-3gg3"
page: "https://infrastack.ai/live/GHSA-cf8x-9m69-3gg3"
kind: "vulnerability"
aliases: ["GHSA-cf8x-9m69-3gg3"]
title: "HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bun", "fixed": ["1.4.4"], "affected": ">= 1.3.14, < 1.4.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["bun", "cwe-770", "http3", "npm", "package", "self-hosted"]
not_affected_if: ["http1-or-http2-only", "http3-off", "no-untrusted-clients"]
published_at: "2026-10-24T00:13:31+00:00"
first_seen_at: "2026-11-09T22:53:15+00:00"
updated_at: "2026-11-09T22:58:55+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3", "first_seen_at": "2026-11-09T22:53:15+00:00"}]
exploit_sources: []
---

# Header Accordions: HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall

Link for people: https://infrastack.ai/live/GHSA-cf8x-9m69-3gg3 (this .md is for agents)

Bun's HTTP/3 support does not limit the decoded size of request headers, so a small QPACK-compressed request can expand into a very large header set. A remote, unauthenticated attacker can exhaust memory or stall a Bun process that uses HTTP/3.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:bun affected >= 1.3.14, < 1.4.4 fixed 1.4.4

## How to check

- Run `bun --version` and check whether it is below `1.4.4`.
- Search your code and config for `http3: true` in `Bun.serve` calls, and for `protocol: "http3"` or `--experimental-http3-fetch` in `fetch` use.
- Check whether any `bun build --compile` executables were built with a version below `1.4.4`.

## Fix

- Bun: upgrade to `1.4.4` and rebuild any `bun build --compile` executables with it.

## Timeline

- 2026-11-09T22:53:15+00:00 ghsa-repo https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3
- [discussion] Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request https://news.ycombinator.com/item?id=50224189

## From the sources

### Summary

A remote, unauthenticated peer can exhaust memory or stall a Bun process that uses HTTP/3. A small request can decode to a very large set of headers, and Bun 1.4.3 and earlier do not limit the decoded size.

This is the "Header Accordions" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected.

Bun 1.4.4 fixes the bug.

### Details

QPACK is the header compression of HTTP/3. A peer can add one large entry to the dynamic table and then refer to that entry many times, with one byte for each reference. Each reference decodes to a full copy of the entry.

`Bun.serve` advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit. It checked only the size of each single header. It also did not limit the number of fields.

Affected:

- `Bun.serve` with `http3: true`. HTTP/3 is off by default.
- The HTTP/3 client of `fetch`. `fetch` uses HTTP/3 only when you ask for it, with `fetch(url, { protocol: "http3" })` or the `--experimental-http3-fetch` flag. A malicious server can attack the client in the same way.

HTTP/1.1 and HTTP/2 are not affected by this bug.

Executables built with `bun build --compile` embed the Bun runtime. An executable built with an affected version stays affected until it is rebuilt.

### Impact

Denial of service. No credentials are necessary. In our tests on Bun 1.4.3:

- About 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed.
- One request of about 20 KB stalled the server for more than a minute, and other requests were not answered during that time.
- A request of about 530 KB kept the server at 100% CPU, and it answered no other requests.

A handler does not need to read the headers. The work happens before Bun calls the handler.

### Patches

Upgrade to Bun 1.4.4, and rebuild any `bun build --compile` executables with it.

Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields (#46392).

This changes behavior for large headers over HTTP/3:

- A `Bun.serve` request over the limit (16 KB by default, set with `--max-http-header-size`) gets a `431` response.
- A much larger request closes the connection.
- `fetch` over HTTP/3 rejects a response with more than 256 KB of headers.

### Workarounds

Do not enable `http3` on a server that untrusted clients can reach, and do not use the HTTP/3 client of `fetch` with untrusted servers. HTTP/1.1 and HTTP/2 are not affected.

### References

- https://foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
- https://github.com/oven-sh/bun/issues/46475
- https://github.com/oven-sh/bun/pull/46392

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_