Bun Initiates Transition from Zig to Rust to Resolve Systemic GC Integration and Memory Safety Bugs
Bun is transitioning its 535,496-line codebase from Zig to Rust to eliminate persistent use-after-free and memory leak vulnerabilities. The architectural move addresses safety limitations when interfacing manual memory management with the garbage-collected JavaScriptCore engine.
Architecture Scaling and Memory Challenges
Bun started in April 2021 as a line-for-line port of esbuild's JavaScript and TypeScript transpiler from Go to Zig, chosen for low-level performance and control. Over five years, the runtime's scope expanded to include a bundler, minifier, npm-compatible package manager, test runner, and native Node.js API implementations. Today, the CLI generates over 22 million monthly downloads and is embedded in runtimes like Vercel and Railway.
However, Bun's massive scope highlighted systemic stability issues. Managing the boundary between JavaScriptCore’s garbage-collected runtime and manual memory management proved highly error-prone. The development team encountered persistent stability issues stemming from how the engine tracks lifetimes of garbage-collected values versus manually-managed memory blocks.
Anatomy of the Integration Bugs
The complexity of GC and manual memory integration manifested in a series of severe memory-safety issues. In Bun v1.3.14, the team addressed several critical bug classes:
- Re-entrant Use-After-Free Crises: In `node:zlib`, async `.write()` operations on the threadpool triggered use-after-free crashes when re-entrant JavaScript callbacks issued concurrent writes or closures. Similar issues occurred in `node:http2` when re-entrant callbacks triggered hashmap rehashing that invalidated internal stream pointers.
- ArrayBuffer Detachment: In `UDPSocket.send()` and `Buffer#copy`, user-defined `valueOf` or `toString` callbacks executed mid-iteration could detach or resize the underlying `ArrayBuffer` between payload capture and the actual system call.
- Memory Leaks: Crypto APIs like `scrypt` leaked password buffers on failed allocations, while `tlsSocket.setSession()` leaked `SSL_SESSION` structures due to missing `SSL_SESSION_free` calls. Watchers in `fs.watch()` were pinned permanently as GC roots due to reference count underflow.
- Race Conditions: In `MessageEvent`, the GC marker thread could observe a torn variant in its internal data during concurrent access from a `BroadcastChannel` or `MessagePort`.
Why Existing Safeguards and Alternatives Failed
To combat these bugs, the Bun team patched the Zig compiler to support Address Sanitizer (ASAN) on every commit, shipped safety-checked `ReleaseSafe` builds on Windows, and fuzzed APIs 24/7 using the V8/JSC fuzzer Fuzzilli. Despite these safeguards, memory corruption and leaks continued to bypass CI.
Zig lacks implicit destructors or constructors, relying on explicit `defer` and `errdefer` statements. In highly concurrent asynchronous code, managing pointer ownership via style guides is difficult to enforce. While the team considered implementing a rigid ownership style guide in Zig, the lack of operator overloading would require highly unergonomic, verbose wrappers for shared pointer structures.
Transitioning fully to C++ (which already makes up 20% of Bun's codebase through JavaScriptCore, uWebSockets, and BoringSSL) would provide RAII but still leave the codebase vulnerable to silent memory corruption and leaks under code-review-enforced style guides.
The Rust Migration Strategy
The team selected Rust due to its compile-time safety guarantees, which convert typical use-after-free and double-free issues into compiler errors. Rust’s implementation of Resource Acquisition Is Initialization (RAII) via the `Drop` trait automatically handles cleanup on error paths, eliminating the risk of forgotten deallocations.
Porting a codebase of 535,496 lines of Zig (excluding comments) represents a massive engineering effort. To minimize shipping delays and prevent freezing feature development or security patches, the team is executing a mechanical port from Zig to Rust with minimal behavioral changes. The migration is being assisted by a pre-release version of Claude Fable 5, following Bun’s acquisition by Anthropic in December 2025.