CVE-2024-21548

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

7.7 HighFix available

Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. Note: This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.67%Up 0.6 points since Dec 19, 2024

What each source reports

CVE List Score used 7.7

Record: CVE-2024-21548
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P
Weakness: CWE-1321, CWE-1321
Updated: 2026-11-02

EUVDEUVD-2024-3614 7.7

Record: EUVD-2024-3614
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v9mx-4pqq-h232 6.8

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.

Record: GHSA-v9mx-4pqq-h232
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

NVD 6.8

Record: CVE-2024-21548
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSV 6.8

Record: CVE-2024-21548
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-1321
Updated: 2026-11-02

OSVGHSA-v9mx-4pqq-h232 6.8

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects.

Record: GHSA-v9mx-4pqq-h232
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`bun` npm	Source text: > 0.0.12, < 1.1.30	1.1.30Not evaluated
`bun` npm	before 1.1.30	1.1.30

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21548 is a high vulnerability (CVSS 7.7) in Bun, published December 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in bun 1.1.30.