Bun 1.4.4 Release New Features and Security Update Explained — What JavaScript Developers Should Know

Image: Wikimedia Commons / Fæ, CC0 — Illustrative image: code on a computer monitor (Bun is a JavaScript runtime; no permitted official product photo in the primary sources)

TL;DR — The bun 1.4.4 release new features security update explained: Bun shipped v1.4.4 on 22 October 2026 with a built-in Prettier-compatible formatter (bun fmt, up to 286x faster), a much faster bun check, and security fixes across Brotli, TLS and HTTP/1.1 to HTTP/3. Run bun upgrade today — it is free and takes seconds.

📌 KEY HIGHLIGHTS

• New formatter: bun fmt is built in and Prettier-compatible — on Prettier's own repo (2,616 files) it finishes in 60 ms vs 17.1 s for Prettier 3.9.10 (~286x faster), and 3x–6x faster than oxfmt (Bun blog, 22 Oct 2026).
• Faster type checking: bun check is 1.4x–7.8x faster on large projects — MUI's docs folder dropped from 10.28 s to 1.31 s, peak memory from 11.2 GB to 1.3 GB.
• Smoother installs: bun install now migrates Yarn Berry lockfiles without re-resolving, retries failed registry requests with real exponential backoff, and links hoisted installs up to 3.2x faster from a warm cache on Linux.
• Security fixes included: fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket and fetch, plus root certs updated to NSS 3.131.1 (per OpenCode 1.19.4 notes, 22 Oct 2026).
• Controversy to watch: RuntimeWire reported that FoxIO researcher Sébastien Féry says Bun never answered his firm's May report of a server-crashing HTTP/3 flaw — the October release adds relevant HTTP/3 limits without mentioning FoxIO.

What happened?

Bun — the fast JavaScript runtime that bundles a bundler, test runner and package manager in one binary — published version 1.4.4 on 22 October 2026, fixing 271 issues (addressing 544 community 👍 reactions). The release lands in the middle of a rough October for runtime security, and it matters for a simple reason: alongside headline features, it patches the Brotli, TLS and HTTP stacks that our Node.js October security release guide warned about this week. Bun is open source and MIT-licensed, owned by Anthropic since December 2025, and its cadence is aggressive — v1.4.3 shipped only on 10 October — so upgrading costs nothing and takes seconds.

Bun 1.4.4 release new features security update explained: the headline features

The star is bun fmt. JavaScript teams currently run Prettier (or the newer oxfmt) as a separate dependency; Bun now ships its own formatter, a port of Prettier's own formatting logic. It reads your existing .prettierrc, prettier.config.*, .editorconfig and even oxfmt configs, honours // prettier-ignore, and handles JS, TypeScript, JSX, CSS, HTML, Vue, Svelte, Markdown, YAML and more. Flags like --check, --staged (formats only what you are about to commit, so you can drop lint-staged) and --doctor (lists packages you can uninstall) make it a genuine Prettier replacement.

Bun's own benchmark numbers, measured on the same machines:

Tool	Project (files)	Time	Peak memory
bun fmt	Prettier's own repo (2,616 files)	59.7 ms	48 MB
Prettier 3.9.10	Same repo	17.1 s	459 MB
bun fmt	vite (2,537 files)	65.2 ms	64 MB
oxfmt 0.74.0	Same repo	406.7 ms	137 MB

Beyond the formatter: bun check is far faster on big codebases (VS Code's own code checks in 2.82 s, down from 4.09 s); bun install finally migrates Yarn Berry (Yarn 2+) lockfiles while preserving every pinned version, and retries flaky registry requests at 50/100/200/400/800 ms with jitter instead of five retries inside 5 ms; Bun.SQL uses up to 48% less CPU per query with new query.cancel() and COPY streams; the WebSocket client was rewritten to behave like npm's ws on Node.js; and a JavaScriptCore upgrade brings up to 54x faster toLocaleString and 2.8x faster Headers iteration.

Image: Wikimedia Commons / Slashme, CC0 — Illustrative image: code on a developer's screen

Why it matters for developers worldwide

Shared native libraries mean shared exposure. The same Brotli decoder and HTTP stack flaws that forced Node.js's emergency release this week live in Bun too, so 1.4.4's fixes for Brotli, TLS, HTTP/1.1–3, WebSocket and fetch are the real reason production and CI users should upgrade promptly — the speed features are the bonus.

The FoxIO disclosure adds a governance question. Bun's own security policy promises acknowledgement of reports within five days; a claimed five-month silence on a server-crashing HTTP/3 bug — with the fix landing uncredited — is the kind of thing that erodes trust in a runtime's security process. Bun.serve users with HTTP/3 should still upgrade (the limits are now in), but watch how Bun responds publicly. For Indian developers — startups and freelancers who adopted Bun because one tool replaces runtime, bundler, test runner and package manager — one bun upgrade now also retires a Prettier dependency and unblocks Yarn Berry migrations in a single move.

Should you care?

✅ Upgrade today if you run Bun anywhere — dev machines, CI or servers: the Brotli/TLS/HTTP security fixes make this mandatory maintenance, and bun fmt can retire a Prettier install. ⏳ Don't switch runtimes for this alone if your Node.js or Deno setup works — Bun is compelling, but migrating production for formatter speed is not a business case. Honest caveat: the benchmarks above come from Bun's own blog; independent reproductions will take a few days.

Price, availability & alternatives

Bun is free and open source (MIT): bun upgrade moves you to 1.4.4; new installs via curl -fsSL https://bun.com/install | bash. It runs on macOS, Linux and Windows (incl. Windows ARM64). Alternatives: Node.js (see our October security release guide for 22.23.4 / 24.22.1 / 26.12.1), Deno 2.9, and the TypeScript 7.1 beta for type-checking upgrades. Bun targets Node.js 26.3 compatibility, so most npm packages just work.

FAQs

What is new in Bun 1.4.4?
Released 22 October 2026, it adds a built-in Prettier-compatible formatter (bun fmt), a 1.4x–7.8x faster bun check, Yarn Berry lockfile migration and retry backoff in bun install, a rewritten WebSocket client, a faster JavaScriptCore engine, and security fixes for Brotli, TLS, HTTP/1.1–3, WebSocket and fetch — 271 issues fixed in total.

Is bun fmt faster than Prettier?
Yes, dramatically: on Prettier's own 2,616-file repo, bun fmt --check takes ~60 ms versus 17.1 s for Prettier 3.9.10 (~286x faster, 48 MB vs 459 MB memory), and it is 3x–6x faster than oxfmt 0.74.0. It reads your existing Prettier or oxfmt config, so switching is low-risk — though these are the Bun team's own benchmarks for now.

How do I upgrade to Bun 1.4.4?
Run bun upgrade in your terminal — that's it. New installs: curl -fsSL https://bun.com/install | bash (macOS/Linux) or powershell -c "irm bun.sh/install.ps1|iex" (Windows). Confirm with bun --version, which should print 1.4.4.

What security fixes are in Bun 1.4.4?
Fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket and fetch, plus bundled root certificates updated to NSS 3.131.1 (per the OpenCode 1.19.4 notes shipping the same runtime). Separately, RuntimeWire reported that FoxIO researcher Sébastien Féry says Bun never acknowledged his firm's May report of a server-crashing HTTP/3 flaw.

TAKEAWAY
Bun 1.4.4 makes Bun a genuine all-in-one toolchain — runtime, installer, test runner, and now a Prettier-fast formatter — with timely security fixes for a rough month in runtime security. One bun upgrade covers it.
Follow World Tech on TechByCountry for the next hourly update.

Sources: Bun — Bun v1.4.4 release notes (22 Oct 2026, primary source) • RuntimeWire — FoxIO researcher says Bun never answered its May report of a server-crashing HTTP/3 flaw (22 Oct 2026) • OpenCode v1.19.4 release notes — bundled Bun 1.19.4 security fixes (22 Oct 2026) • endoflife.date — Bun 1.4.4 released 22 Oct 2026