Security firm FoxIO published research on 20 October 2026 ('Header Accordions') showing that a remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends, and FoxIO says one connection is enough to run a default-configured server out of memory or pin it.

FoxIO says seven of the ten HTTP/3 implementations it tested are vulnerable because limits on decoded QPACK (HTTP/3 header compression) headers are missing, incomplete or applied too late, so a small HEADERS frame can expand into hundreds of thousands of header objects in memory. In FoxIO's tests a 1,000,000-byte QPACK block decoded into about 160,000 fields and kept roughly 15 MiB in a quic-go request (about 15 times the encoded size); FoxIO measured about 600–1,800 times amplification on lsquic and about 4,000 times on Bun, and says a separate Bun bug lets a single stream of about 516 KiB leave the server at 100% CPU with no recovery.

FoxIO says quic-go is the Go library behind Caddy, Traefik and cloudflared. Per FoxIO, fixes are out in quic-go 0.57.0 (CVE-2025-64702), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE) and Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945, a crash in its HTTP/3 dissector rather than a server flaw), while Bun 1.4.3, the hyperium h3 Rust library and aioquic / mitmproxy were unpatched as of 20 October; FoxIO lists Google quiche, IIS and ngtcp2/nghttp3 as not vulnerable.

FoxIO has published reproduction code. Primary: FoxIO. Updated 22 Oct 2026: The Hacker News reported the research, saying the flaws cause denial of service only, with no public reports of attacks in the wild. (source: The Hacker News)

Updated 25 Oct 2026: Bun published advisory GHSA-cf8x-9m69-3gg3 on 24 October, rated High by Bun with no CVE, saying Bun 1.4.4 fixes the bug; Bun says versions from 1.3.14 up to but not including 1.4.4 are affected, and its release page shows 1.4.4 was released on 22 October.

Bun says only Bun.serve with http3: true (HTTP/3 is off by default) and the HTTP/3 client of fetch are affected, that HTTP/1.1 and HTTP/2 are not, and that executables built with bun build --compile stay affected until rebuilt with 1.4.4. In Bun's own tests on 1.4.3, one request of about 20 KB stalled a server for more than a minute. (source: Bun GitHub advisory GHSA-cf8x-9m69-3gg3)