Experiments
Stop when this page is not the decision
A published page can record a stop. It does not, by itself, record the next plan.
github.com published this account (2026-10-24): Bun published repository advisory GHSA-cf8x-9m69-3gg3 (severity high) at 2026-10-24T00:13:31Z. Affected: bun >= 1.3.14, < 1.4.4. A remote, unauthenticated peer can exhaust memory or stall a Bun process using HTTP/3 because decoded QPACK header size was not limited (the 'Header Accordions' attack FoxIO published Oct 20, 2026). Affects Bun.serve with http3: true (off by default) and the fetch HTTP/3 client (protocol: 'http3' or --experimental-http3-fetch). HTTP/1.1 and HTTP/2 not affected. Executables built with bun build --compile stay affected until rebuilt. Fixed in Bun 1.4.4 (released 2026-10-22T10:11:32Z). CVE pending. Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS. Event time (UTC): 2026-10-24T00:13:31Z. Security record: GHSA-cf8x-9m69-3gg3. Fixed release: Bun 1.4.4 https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4. Discovery confidence: High.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: Bun published repository advisory GHSA-cf8x-9m69-3gg3 (severity high) at 2026-10-24T00:13:31Z. Affected: bun >= 1.3.14, < 1.4.4. A remote, unauthenticated peer can exhaust memory or stall a Bun process using HTTP/3 because decoded QPACK header size was not limited (the 'Header Accordions' attack FoxIO published Oct 20, 2026). Affects Bun.serve with http3: true (off by default) and the fetch HTTP/3 client (protocol: 'http3' or --experimental-http3-fetch). HTTP/1.1 and HTTP/2 not affected. Executables built with bun build --compile stay affected until rebuilt. Fixed in Bun 1.4.4 (released 2026-10-22T10:11:32Z). CVE pending. Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS. Event time (UTC): 2026-10-24T00:13:31Z. Security record: GHSA-cf8x-9m69-3gg3. Fixed release: Bun 1.4.4 https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4. Discovery confidence: High.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
A published page can record a stop. It does not, by itself, record the next plan.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Bun HTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall (GHSA-cf8x-9m69-3gg3, high).