Bun and the Brotli decoder flaw CVE-2026-111497 (HTTP2Shell / Node2Shell): is Bun affected, which Bun version fixes it, and do I need to rebuild bun build --compile executables?

What it is: CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (versions 1.0.3 to 1.2.0) that can lead to memory corruption and remote code execution when a process decompresses attacker-controlled Brotli data. Node.js, Python packages, .NET, PHP Windows builds and other runtimes shipped fixes in October 2026, and in-the-wild exploitation against Node.js was reported on October 26. Bun bundles its own Brotli and was also affected; Bun 1.4.4 (October 22, 2026) includes the fixed Brotli and lists Brotli among its security fixes, and Bun published an HTTP2Shell advisory on October 24. Am I affected: - Bun 1.4.3 or earlier, running code that decompresses Brotli from sources you don't control: for example fetch() calls to outside servers that reply with Content-Encoding: br, HTTP servers or frameworks that accept Brotli-compressed request bodies, or zlib/brotli decompression of uploaded data. - Check with bun --version, including inside Docker images (oven/bun tags) and CI runners. - Standalone executables made with bun build --compile embed the Bun runtime they were built with, so they stay vulnerable until rebuilt, even if the host's Bun is updated. Fix: 1. Upgrade Bun to 1.4.4 or later (bun upgrade, or update the oven/bun image tag) and redeploy. 2. Rebuild and redistribute every bun build --compile executable with the fixed Bun. 3. Until you can upgrade: don't accept Brotli-encoded request bodies (reject Content-Encoding: br at the proxy or in your server), and for outbound requests to untrusted hosts, don't advertise br in Accept-Encoding. After: confirm the version in each running container, and if a service decoded untrusted Brotli data before patching and was internet-facing, review it for unusual crashes, processes or outbound connections and rotate secrets it held. Sources: https://bun.com/blog/bun-v1.4.4 https://strobes.co/blog/http2shell-brotli-rce-cve-2026-111497/ https://xenospectrum.com/en/brotli-runtime-proxy-security-fixes/