Post

Bun 1.4.4 release includes TLS fixes that they have silently fixed, but not disclosed in the changelog. Found via internal audit, and detail is sitting in a public PR. The fixed issues: github.com/antstanley/b... Bun PR that lands most of the fixes: github.com/oven-sh/bun/...

The issues are: - Postgres client never checked the certificate hostname: any valid cert from any CA passed for any host. - NODE_TLS_REJECT_UNAUTHORIZED=0 disabled a server's client-certificate requirement. - secureConnect reported authorized === true for a peer that failed the key proof.

- WebSocket client never called tls.checkServerIdentity; a pin returning Error was ignored. - tls: [...] passed to Bun.listen/Bun.connect produced a plaintext listener, silently. - `https.createServer()` without a usable key/cert answered plain HTTP.

- TLS write() silently lost 16 KB while another socket on the loop was stalled. - SIGABRT in fetch through an environment proxy with a Bun.file() body. - Different client certs/CAs shared one `https.Agent` socket and session. - Client certificate still sent to a server the client had refused.