CVE-2024-21548: Bun Package Prototype Pollution Vulnerability
Summary
CVE-2024-21548: Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo. Affects bun versions < 1.1.30. Fixed in 1.1.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bun is a modern JavaScript runtime that aims to provide a fast and efficient environment for running JavaScript applications. It includes a native API for various functionalities, allowing developers to build applications with high performance. However, versions prior to 1.1.30 are susceptible to an Application-level Prototype Pollution vulnerability, which can lead to severe security issues if exploited.
Vulnerability Detail
The vulnerability arises from improper input sanitization in Bun's APIs that accept objects. An attacker can exploit this flaw to manipulate the prototype of objects, potentially leading to unauthorized access or modification of application data. This can have significant ramifications, including data leakage, application crashes, or even complete system compromise. The vulnerability is classified under CWE-1321, indicating its nature as a prototype pollution issue.
How To Fix
Latest published version: 1.4.4 as of 23 Oct 2026
npm install bun@1.4.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.30
This is the first release that contains the fix.
npm install bun@1.1.30Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization in your application to prevent untrusted data from being processed by Bun's APIs. This can help mitigate the risk of prototype pollution until the package is updated.
Conclusion
The Bun package has a significant vulnerability (CVE-2024-21548) that allows for prototype pollution due to improper input sanitization. It is crucial to update to version 1.1.30 or later to protect your applications from potential exploitation. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for bun →
FAQ
Prototype Pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to unexpected behavior in applications.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized data access, application crashes, or even full system compromise, depending on how the application handles object prototypes.
Yes, implementing strict input validation and sanitization can help mitigate the risks associated with this vulnerability until you can update the Bun package.
The CVSS score for this vulnerability is 7.5, indicating a moderate to high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bun.
