Bun fixes an HTTP/3 bug that could stall a server with a 20 KB request
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Bun 1.4.4 patches a QPACK amplification flaw ("Header Accordions", published by FoxIO) in HTTP/3, where a small request decodes into a huge header set and Bun 1.4.3 and earlier never enforced its advertised 16 KB limit. Bun's own tests show about 6 MB of traffic exhausting a 2 GB server and a 20 KB request stalling it for over a minute. Only servers with http3: true and opt-in HTTP/3 fetch are affected; compiled executables need rebuilding. Most figures come from the advisory itself.