Post

Bun 1.4.4 release includes TLS fixes that they have silently fixed, but not disclosed in the changelog. Found via internal audit, and detail is sitting in a public PR. The fixed issues: github.com/antstanley/b... Bun PR that lands most of the fixes: github.com/oven-sh/bun/...

- WebSocket client never called tls.checkServerIdentity; a pin returning Error was ignored. - tls: [...] passed to Bun.listen/Bun.connect produced a plaintext listener, silently. - `https.createServer()` without a usable key/cert answered plain HTTP.

- PGSSLMODE=verify-* silently dropped when a TLS_* URL variable was also present. - Revoked client certificates accepted; the mTLS server never saw a CRL. - Use-after-free from destroy() in ALPNCallback. - Heap-use-after-free in the stream TLS engine (ASAN, found by audit).

- TLS write() silently lost 16 KB while another socket on the loop was stalled. - SIGABRT in fetch through an environment proxy with a Bun.file() body. - Different client certs/CAs shared one `https.Agent` socket and session. - Client certificate still sent to a server the client had refused.