Exclusive: FoxIO researcher says Bun never answered its May report of a server-crashing HTTP/3 flaw
Sébastien Féry told RuntimeWire that FoxIO reported the flaw through the channel in Bun's security policy and "never heard back." Bun shipped HTTP/3 security fixes Thursday in a release that doesn't mention FoxIO or the report.
By Emerson Redding · Published · Updated
Primary source: github.com
Why it matters
Féry says Bun's security process failed at the first step: a published five-day acknowledgment commitment offers little protection when a report goes unanswered for months. The October release adds relevant HTTP/3 limits.
A security researcher whose firm found a way to knock Bun web servers offline with about half a megabyte of traffic says the JavaScript runtime's team never responded when FoxIO reported the flaw five months ago.
"We contacted Bun via the channel advertised in their SECURITY.md. We never heard back," Sébastien Féry, a researcher at security firm FoxIO, told RuntimeWire in an email Thursday morning.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.