Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
oven-sh/bun
main @ e550f2c
925
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Denial of Service: 588 prior fixes. Scrutinize any change in this area.
src/bun.js/api/server.zig: most-fixed (20 issues). Treat as high-risk during review.
416 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Accepting untrusted SSL/TLS certificates by default inside Bun's socket connections and listener upgrades allows immediate man-in-the-middle (MitM) attacks. Developers must verify that certificate validation configuration flags are explicitly checked and rejected by default on connection initialization.
Prototype Pollution: Passing unvalidated user-controlled objects to various Bun APIs allowed modification of the global Object.prototype structure (CVE-2024-21548). Restricting option lookups to own-properties is essential to prevent prototype-traversing side effects and require hijacking.
Use After Free: Accessing self state after synchronous socket destruction inside connection error/close callbacks or during concurrent keep-alive TLS handshakes leads to catastrophic heap use-after-free vulnerabilities.