What happened
Bun published security advisory GHSA-663w-cv8g-jj2p on October 23, 2026 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with the runtime. The advisory marks the issue high severity. It says Bun versions from 1.0.21 through 1.4.3 are affected and identifies Bun 1.4.4 as the patched release. Bun 1.4.4 updates its bundled Brotli from version 1.2.0 to 1.2.1.
The defect is in the upstream Brotli library rather than Bun's own code. According to the advisory, affected Brotli versions span 1.0.3 through 1.2.0, except for the fixed 1.0.10 and 1.1.1 releases. The Brotli project says the vulnerability can permit remote code execution. Bun says it has not tested an attack against Bun itself, so it does not claim that exploitation has the same consequences there as in other software. Its operational advice is nevertheless to treat the issue as a remote-code-execution risk.
The important implementation detail is that the decoder can be reached through ordinary runtime features. Bun's fetch sends Accept-Encoding: gzip, deflate, br, zstd by default and automatically decodes responses carrying Content-Encoding: br. A server an application connects to can therefore send Brotli data to the decoder. The advisory also names the Brotli functions in node:zlib, including brotliDecompress, brotliDecompressSync, and createBrotliDecompress, as well as Brotli-format DecompressionStream use.
For fetch, Bun names a malicious server as one attack path. An attacker on the network path of an unencrypted connection is another. More generally, any application path that passes untrusted data into the listed Brotli interfaces deserves review. After the update, malformed input fails with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, according to the advisory.
The patch action has two parts. Teams should upgrade their runtime to Bun 1.4.4. They must also rebuild executables created with bun build --compile, because those artifacts embed the Bun runtime and remain affected until rebuilt. Bun offers no process-wide workaround. For a specific fetch request, decompress: false prevents sending Accept-Encoding: br and prevents Brotli response decoding, but it applies only to that request. The advisory also recommends not sending untrusted data to the Brotli APIs in node:zlib or a Brotli DecompressionStream.
What the archive adds
This is a new fact on a known story: the upstream vulnerability and its fixed Brotli releases were covered in the initial release note and deployment-oriented coverage. Bun's advisory supplies the product-specific affected range, reachable APIs, upgrade target, and compiled-artifact requirement.
Trend signal
No supplied pattern genuinely fits this runtime-specific security patch.
Why now
Bun published its advisory on October 23, 2026, after Node.js published fixes on October 21, according to the advisory. The relevant decision is immediate because the vulnerable decoder is bundled into affected Bun versions and because compiled Bun artifacts do not inherit the fix until they are rebuilt.
Connections to other events
A later archive report says public proof-of-concept exploits and a first attempted in-the-wild exploitation had been reported for this Brotli flaw, alongside fixes in .NET and PHP for Windows: Tenable coverage. That report concerns the same CVE; Bun's advisory itself does not claim a demonstrated exploit against Bun.
Why it matters
The practical risk is not limited to services that deliberately decompress uploaded archives. Automatic HTTP response decompression creates a route from a remote server response to a native decoder in a common application call. That makes runtime inventory consequential: a team may have Bun in local tooling, CI, servers, or compiled command-line binaries, each with different upgrade ownership.
The compiled-executable detail is especially important for release engineering. Updating a build image or developer machine does not patch an already distributed executable made with bun build --compile. Teams need to identify such artifacts, rebuild them under Bun 1.4.4, and replace deployed copies. A narrow request-level workaround may help contain a specific integration, but it is not a substitute for patching the runtime.
Limits and uncertainty
The advisory establishes an affected version range, affected interfaces, and the patched Bun release. It does not demonstrate a working exploit against Bun or quantify the likelihood of exploitation in a particular deployment. Its remote-code-execution characterization relies on the upstream Brotli project's statement, while Bun explicitly says it has not tested how impact in Bun compares with other software. It also does not provide an inventory method for every embedded executable, so organizations must validate their own build and distribution paths.
Skill to build now
Build a small runtime exposure checklist this week. Enumerate Bun versions in CI images, deployment images, developer tooling, and compiled deliverables; search release pipelines for bun build --compile; then identify outbound fetch calls and code that accepts compressed data. Make the rebuild step explicit in the remediation ticket rather than treating a package-manager update as sufficient proof of closure.
Reader takeaway
Upgrade affected Bun installations to 1.4.4, then rebuild every executable produced with bun build --compile. Treat automatic Brotli decoding in fetch as part of the exposure review: it can process server-supplied compressed responses without an application explicitly calling a Brotli API.