{"action":"Upgrade bun to 1.4.4 or later.","affected":[{"fixed":"1.4.4","introduced":"1.3.14"}],"component":"bun","cve_ids":[],"ecosystem":"bun","exploited":false,"fixed_versions":["1.4.4"],"ghsa_id":"GHSA-cf8x-9m69-3gg3","id":"tcs_01M5NMGBSZQ39811JF2RQSHPW2","modified_at":"2026-10-24T00:13:31Z","published_at":"2026-10-24T00:13:31Z","references":["https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3"],"severity":{"label":"high"},"sources":[{"source":"bun-runtime","source_id":"GHSA-cf8x-9m69-3gg3","url":"https://github.com/oven-sh/bun/security/advisories/GHSA-cf8x-9m69-3gg3"}],"summary":"HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall"}