Bun's Brotli decoder doesn't have the fix for CVE-2026-111497, the Brotli decoder out-of-bounds write fixed in the Node.js 2026-10-21 security release (22.23.4, 24.22.1, 26.12.1). The fix comes from upstream google/brotli@ 0ed4268 , and no brotli release contains it yet.
Every Bun release is affected: ≤1.4.2 builds brotli v1.1.0. 1.4.3 and main build v1.2.0 ( 028fb5a2 ). Bun applies no brotli patches.
≤1.4.2 builds brotli v1.1.0.
1.4.3 and main build v1.2.0 ( 028fb5a2 ).
Bun applies no brotli patches.
The c/dec/decode.c Bun compiles is byte-identical to Node's pre-fix copy: v1.1.0 matches Node v22, and v1.2.0 matches Node v24/v26.
The decoder is reached by default from fetch() on any Content-Encoding: br response, and also from node:zlib and DecompressionStream("brotli") .
Node's public regression vector (from test/parallel/test-zlib-invalid-input.js ) shows the difference. Bun 1.3.14 and 1.4.2 fail with BLOCK_LENGTH_1 (-9), like unpatched Node. Patched Node rejects it early with BLOCK_SWITCH (-17).
#46351 backports 0ed4268a as patches/brotli/*.patch . It also adds the new -17 variant to BrotliDecoderErrorCode2 ; without it the patched decoder would hand Rust an invalid enum discriminant. It exposes the constant as Node does and ports Node's regression test.
That PR comes from a fork, so Buildkite build #130174 is blocked. @Jarred-Sumner @alii , could one of you unblock it, or push the branch ( fredluz:claude/brotli-block-switch-cve-2026-111497 ) to oven-sh/bun so CI can run?
Also behind, but separate: c-ares is still 1.34.8, and 1.34.9 is a security release.
Jarred-Sumner added a commit that references this issue on Oct 22, 2026 Fix regressions since 1.4.3 in bun install, bunx, node:fs and node:ht… This issue will close once commit 2a5cbbc is merged into the 'main' branch. 2a5cbbc
Fix regressions since 1.4.3 in bun install, bunx, node:fs and node:ht…
Jarred-Sumner closed this as completed in #46392 on Oct 22, 2026
grumitos added a commit that references this issue on Oct 22, 2026 fix: keep Bun's Brotli decoder out of the tracker's Riot requests (CV… 3618942
fix: keep Bun's Brotli decoder out of the tracker's Riot requests (CV…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
