Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request
Comments on “Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Bun 1.4.4 patches a QPACK amplification flaw ("Header Accordions", published by FoxIO) in HTTP/3, where a small request decodes into a huge header set and Bun 1.4.3 and earlier never enforced its advertised 16 KB limit. Bun's own tests show about 6 MB of traffic exhausting a 2 GB server and a 20 KB request stalling it for over a minute. Only servers with http3: true and opt-in HTTP/3 fetch are affected; compiled executables need rebuilding. Most figures come from the advisory itself.
Why it ranked
No. 14 of 93 with a score of 0.66. The panel rated it highest on new information (0.94) and practical relevance (0.84), lowest on audience breadth (0.32).
Every answer behind this is in the table under Score.
Score
0.66total under rubric v2.2
- Significance0.54
- Reader interest0.75
- Audience breadth0.32
- Practical relevance0.84
- Substantiated0.83
- Technical depth0.80
- New information0.94
- Counts against: Promotional0.04
- Counts against: Overclaim0.11
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.52 | 0.45 | 0.65 | 0.54 | 0.20 | +0.24 | +0.129 |
| Reader interest | 0.65 | 0.72 | 0.88 | 0.75 | 0.23 | +0.26 | +0.195 |
| Audience breadth | 0.23 | 0.40 | 0.34 | 0.32 | 0.17 | +0.13 | +0.042 |
| Practical relevance | 0.89 | 0.80 | 0.82 | 0.84 | 0.09 | +0.22 | +0.184 |
| Substantiated | 0.81 | 0.80 | 0.88 | 0.83 | 0.08 | +0.05 | +0.042 |
| Technical depth | 0.88 | 0.75 | 0.76 | 0.80 | 0.13 | +0.05 | +0.040 |
| New information | 0.95 | 0.90 | 0.98 | 0.94 | 0.08 | +0.05 | +0.047 |
| Promotional | 0.04 | 0.05 | 0.02 | 0.04 | 0.03 | −0.19 | −0.007 |
| Overclaim | 0.14 | 0.15 | 0.03 | 0.11 | 0.12 | −0.11 | −0.012 |
| Sum of contributions | +0.660 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.660 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-25/14/"><img src="https://rubric.hrih.si/badge/2026-10-25/14.svg" alt="Ranked #14 on Rubric, 25 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 1 matches source · 5 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceDate
The "Header Accordions" QPACK amplification attack was published by FoxIO on October 20, 2026, and the write-up lists Bun as affected.
The cited source says the same thing.
The article says “This is the "Header Accordions" QPACK amplification attack that FoxIO published on October 20, 2026. The write-up lists Bun as affected”
The source says “Oct 20 2026 - blog published”
Source cited by the article: foxio.io/blog/header-accordions-qpack-amplification-attacks-against-http-3-servers
Couldn’t checkVersion
Bun 1.4.3 and earlier do not limit the decoded size of HTTP/3 request headers, and Bun 1.4.4 fixes the bug.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Bun 1.4.3 and earlier do not limit the decoded size”
The source says No passage could be compared.
Source cited by the article: github.com/oven-sh/bun/pull/46392
No source givenNumber
Bun.serve advertised a 16 KB limit for a set of request headers but did not enforce it, checking only each single header's size and not limiting the number of fields.
The article gives no link or citation for it.
The article says “Bun.serve advertised a limit of 16 KB for a set of request headers, but it did not enforce the limit”
The source says No source to compare with.
No source givenNumber
In tests on Bun 1.4.3, about 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed.
The article gives no link or citation for it.
The article says “About 6 MB of traffic made a server with a 2 GB memory limit run out of memory and get killed”
The source says No source to compare with.
No source givenNumber
In tests on Bun 1.4.3, one request of about 20 KB stalled the server for more than a minute, during which other requests were not answered.
The article gives no link or citation for it.
The article says “One request of about 20 KB stalled the server for more than a minute, and other requests were not answered during that time”
The source says No source to compare with.
No source givenNumber
In tests on Bun 1.4.3, a request of about 530 KB kept the server at 100% CPU and it answered no other requests.
The article gives no link or citation for it.
The article says “A request of about 530 KB kept the server at 100% CPU, and it answered no other requests”
The source says No source to compare with.
Couldn’t checkVersion
Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Bun 1.4.4 enforces a limit on the decoded size of a set of headers, counted as in RFC 9114 section 4.2.2, and limits the number of fields”
The source says No passage could be compared.
Source cited by the article: github.com/oven-sh/bun/pull/46392
No source givenGeneralization
HTTP/1.1 and HTTP/2 are not affected by this bug.
The article gives no link or citation for it.
The article says “HTTP/1.1 and HTTP/2 are not affected by this bug”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 25 Oct 2026, 05:46 UTC. It played no part in the ranking.