Post

Ant Stanley
@iamstan.dev

Bun 1.4.4 release includes TLS fixes that they have silently fixed, but not disclosed in the changelog. Found via internal audit, and detail is sitting in a public PR. The fixed issues: github.com/antstanley/b... Bun PR that lands most of the fixes: github.com/oven-sh/bun/...

Ant Stanley@iamstan.dev

And they've just released Bun 1.4.4 to resolve the most important issues.

0 reposts0 likes

Ant Stanley
@iamstan.dev

The issues are: - Postgres client never checked the certificate hostname: any valid cert from any CA passed for any host. - NODE_TLS_REJECT_UNAUTHORIZED=0 disabled a server's client-certificate requirement. - secureConnect reported authorized === true for a peer that failed the key proof.

Ant Stanley
@iamstan.dev

- WebSocket client never called tls.checkServerIdentity; a pin returning Error was ignored. - tls: [...] passed to Bun.listen/Bun.connect produced a plaintext listener, silently. - `https.createServer()` without a usable key/cert answered plain HTTP.

Ant Stanley
@iamstan.dev

- PGSSLMODE=verify-* silently dropped when a TLS_* URL variable was also present. - Revoked client certificates accepted; the mTLS server never saw a CRL. - Use-after-free from destroy() in ALPNCallback. - Heap-use-after-free in the stream TLS engine (ASAN, found by audit).

Ant Stanley
@iamstan.dev

- TLS write() silently lost 16 KB while another socket on the loop was stalled. - SIGABRT in fetch through an environment proxy with a Bun.file() body. - Different client certs/CAs shared one `https.Agent` socket and session. - Client certificate still sent to a server the client had refused.