Repository navigation
Pin Bun to 1.4.4 for Brotli RCE fix (CVE-2026-111497) - #5
Merged
Merged
Conversation
1 of 2 tasks
Bun bundles the same Google Brotli decoder as Node.js and is affected by CVE-2026-111497; the fix shipped in Bun 1.4.4. Pin the base image so the patched runtime is verifiable, and force the CI build to pull the base image so a cached layer can never reintroduce an unpatched runtime. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
rphovley
force-pushed
the
fix/bun-1.4.4-brotli-cve
branch
from
October 23, 2026 17:57
6e9b08e to
5c8e2fd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
oven/bun:1.4.4, the first Bun release containing the upstream Brotli decoder fix for CVE-2026-111497 (DigitalOcean's October 2026 notice).pull: trueto the CI build step so the runner always fetches the base image instead of reusing a cached, unpatched layer.Context
This service runs on Bun, not Node, but Bun ships the same Google Brotli library and is affected. Merging to
maintriggers the image build and the production deploy workflow.Test plan
ebb-platformand/healthreturns 200docker exec ebb-platform bun --versionreports 1.4.4🤖 Generated with Claude Code