bun-rust

Bun (Rust Port) Audit Findings

Security audit of the in-progress Rust port of Bun, the JavaScript/TypeScript runtime, bundler, package manager and test runner. Each finding includes a detailed write-up and a patch.

The audit was run against the rust branch of Bun at git HEAD 13f9cff919848ef0b25d4feda0f9bac86280ff8e, dated May 12, 17:49:03.

Summary

Total findings: 105 -- High: 34, Medium: 67, Low: 4

Findings

TLS and cryptography

#	Finding	Severity
001	CSPRNG no-op on Android and unsupported Unix targets	High
008	IP-address TLS endpoints skip hostname verification	High
034	VerifyFull skips hostname check without configured SNI	High
041	Server-chosen RSA key receives password encryption	High
050	sslmode=require downgrades to plaintext	High
051	VerifyFull skips hostname without SNI	High
071	UTF-8 cache output skips integrity check	High
103	scryptSync ignores derivation errors	High
079	Malformed IP SAN causes out-of-bounds read	Medium
099	MD5-SHA1 EVP wrapper underallocates digest output	Low

Package manager and lockfiles

#	Finding	Severity
005	Git committish parsed as git-log option	High
011	Fixed temp node shim trusts preexisting symlink	High
012	Bin paths escape the package root	High
054	npm tarball URL can receive registry authorization	High
094	Crafted lockfile offsets create misaligned typed slices	High
111	Streaming decompression has no output limit	High
010	publishConfig tag injects dist-tags	Medium
013	Package name controls tarball output path	Medium
018	Duplicate credentials survive cross-origin redirect stripping	Medium
020	Invalid whoami JSON aborts package manager	Medium
023	Non-2xx streamed tarball responses buffer without a cap	Medium
024	Unbounded cache folder name copy overflows fixed buffer	Medium
042	Archive files trusts declared entry size	Medium
060	Aborted pending response leaks heap allocation	Medium
065	Empty Yarn spec panics name extraction	Medium
066	Malformed os metadata panics Yarn lockfile parser	Medium
067	npm alias resolved path panics extraction	Medium
070	Overlong bin name panics linker	Medium
072	Tar entry size drives unchecked allocation	Medium
086	Duplicate git URL underflows remaining counter	Medium
093	Odd-length shasum panics parser	Medium
095	Overlong package path panics during dependency resolution	Medium
096	Overlong bundled dependency path panics during parse	Medium
098	Tar entry size drives unbounded allocation	Medium
108	Crafted dependency path overflows path buffer	Medium
109	Malformed workspace version arrays panic loader	Medium
047	Root link lockfile entry crashes migration	Low

Patch subcommand

#	Finding	Severity
055	Patch deletion path escapes patch directory	High
056	Patch creation path escapes patch directory	High

Parser, lexer and transpiler

#	Finding	Severity
046	Long flat brace token stream wraps parser cursor	High
068	Multibyte EOF codepoint overreads source buffer	High
097	Unsafe WTF-8 decoder forms out-of-bounds array reference	High
002	Crafted JSX-like object panics console formatter	Medium
006	Malformed package script value panics	Medium
025	Empty JSX entity panics lexer	Medium
026	Leading out-of-range Unicode escape panics	Medium
040	Malformed inline sourcemap URL panics parser	Medium
045	parseArgs panics on throwing argument coercion	Medium
052	Non-string serve plugin value panics	Medium
053	Recursive declare modifiers exhaust parser stack	Medium
057	Dotted namespace recursion exhausts parser stack	Medium
058	Template literal macro invocation panics	Medium
077	EOF comment in directive loops forever	Medium
081	Truncated UTF-8 literal panics parser	Medium
092	Unbounded recursive array parsing	Medium
113	Oversized source map panics while reporting parse errors	Medium
115	Malformed .bun length panics parser	Medium

Bundler and source maps

#	Finding	Severity
075	Unescaped macro name injects generated macro wrapper	High
105	Raw multiline path comment injects bundle code	High
029	Unescaped route filename injects into generated HTML	Medium
090	Sourcemap original line indexes coverage hits out of bounds	Medium
114	Unescaped CSS source path breaks out of generated comment	Medium
091	Newline in source path injects LCOV records	Low

Markdown rendering

#	Finding	Severity
082	Tag filter emits raw body text after escaping disallowed opener	High
083	Carriage return bypasses disallowed tag detection	High
076	Unmatched emphasis delimiters cause quadratic parsing	Medium
085	Unresolved color parsing bypasses nesting limit	Medium
112	Quadratic reference definition duplicate checks	Medium

Routing

#	Finding	Severity
017	Malformed optional catchall route panics validation	Medium
048	Missing parameter segment panics route matching	Medium
049	Catch-all route panics after 64 segments	Medium

HTTP, HTTP/2 and WebSocket

#	Finding	Severity
039	Peer max frame size zero causes continuation loop	High
009	Incomplete upgrade response buffers without limit	Medium
037	CRLF accepted in signed header value	Medium
100	Unbounded request body buffering	Medium
116	unref nested worker can outlive parent VM	Medium
027	Encoded slash check runs after percent decoding	Medium

Redis / RESP client

#	Finding	Severity
101	Unbounded RESP aggregate length allocation	High
036	Incomplete RESP frames buffered without limit	Medium

S3 and Blob storage

#	Finding	Severity
014	Blob-backed images skip encoded file size cap	Medium
033	S3 blob reads leak downloaded bodies	Medium
061	Oversized UploadId panics fixed query buffer	Medium
062	Malformed S3 error XML panics tag slicing	Medium
074	Malformed S3 error message panics	Medium

Shell builtins and command execution

#	Finding	Severity
004	Nested subshells recurse without limit	Medium
022	GitHub Actions command injection via timeout test name	Medium
028	Newline in script path injects crontab entries	Medium
064	Recursive env substitution stack exhaustion	Medium

File system, paths and globs

#	Finding	Severity
015	Non-UTF-8 paths enter unchecked str conversion	High
021	Recursive readdir creates concurrent mutable aliases	High
032	Snapshot updater follows symlinks	High
104	Parallel callback creates aliasing mutable references	High
016	Repeated descriptor receipt leaks previous fd	Medium
063	Invalid UTF-8 glob panics absolute-path slicing	Medium
069	Package entry point escapes project directory	Medium
089	Pollable file readers ignore highwater backpressure	Medium
088	Predictable /tmp script file enables local code injection	Low

JS bindings, memory safety and ABI

#	Finding	Severity
003	Raw sentinel grants JS object reference	High
031	Negative byteOffset escapes ArrayBuffer bounds	High
059	Unsafe decoder forms out-of-bounds array reference	High
084	Shifted pointer used as Vec allocation base	High
106	Forged LINKEDIT size drives unsafe vector length	High
080	Clamp reduction unwraps removed maximum	Medium
102	Mask expansion panics after RTL index drift	Medium
107	Crafted parent chain overflows depth buffer	Medium