Bun
Product · by AnthropicBun is a JavaScript runtime, package manager and test runner designed as a drop-in replacement for Node.js. Bun uses Safari's JavaScriptCore as its JavaScript engine, unlike Node.js and Deno, which run on the V8 engine used by Chromium.
From Wikipedia, licensed under CC BY-SA 4.0. Shown as published there.
Facts
- Latest version
- 1.4.4 (2026)Source: Wikidata
- Licence
- MIT LicenseSource: Wikidata
- Runs on
- Linux, macOS, Microsoft WindowsSource: Wikidata
- Wikipedia
- Read on WikipediaSource: Wikidata
Vulnerabilities
1 CVE in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-111497 Exploited added to KEV 27 Oct
Am I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-111497 before 1.4.4 · fixed in 1.4.4
Security timeline
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.