oven-sh/bun · critical · InitError

FailedToOpenSocket

Error message

FailedToOpenSocket

What it means

The TLS socket context for Bun's HTTP client thread could not be created for a reason not covered by the CA-specific variants (src/http/HTTPContext.rs:522-526): invalid cipher list, invalid ECDH curve, or an unspecified failure; it is also the mapping target for raw uSockets connect errors (From<ConnectError>, src/http/error.rs:357-361). The default init handler prints 'failed to start HTTP client thread' and calls Global::crash() — the process exits (src/http/HTTPThread.rs:375-379).

Source

Thrown at src/http/InitError.rs:3

#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum InitError {
    #[error("FailedToOpenSocket")]
    FailedToOpenSocket,
    #[error("LoadCAFile")]
    LoadCAFile,
    #[error("InvalidCAFile")]
    InvalidCAFile,
    #[error("InvalidCA")]
    InvalidCA,
    #[error("InvalidCRL")]
    InvalidCRL,
}

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Remove or simplify custom `ciphers`/`ecdhCurve` TLS options — Bun's BoringSSL defaults are correct for nearly all servers.
2. Validate any cipher list with BoringSSL semantics (`openssl ciphers '<string>'` is approximate; prefer Bun defaults).
3. If in CI, raise fd/memory limits or run outside the sandbox to see if context creation succeeds.
4. Update Bun — mappings and defaults for socket-context failures have improved across releases.

Example fix

// before
await fetch('https://example.com', { tls: { ciphers: 'DES-CBC3-SHA:RC4-SHA' } }); // BoringSSL rejects
// after: rely on defaults
await fetch('https://example.com');

// Before configuring custom TLS, sanity-check the cipher suite string
import { execSync } from 'node:child_process';
function ciphersLookValid(list) {
  try { return execSync(`openssl ciphers '${list}'`, { stdio: 'pipe' }).toString().trim().length > 0; }
  catch { return false; }
}
const opts = ciphersLookVectorSafe => ciphersLookValid(CIPHERS) ? { tls: { ciphers: CIPHERS } } : {};

When it happens

Trigger: Configuring fetch/Bun.install TLS options with a cipher string BoringSSL rejects or an unsupported ecdhCurve; fd/memory exhaustion at context creation; any uws connect failure mapping through ConnectError. Surfaced at the first HTTPS request or `bun install` run.

Common situations: Copying Node's `ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:...'` config that includes ciphers BoringSSL dropped; setting an ecdhCurve name not compiled into the TLS stack; heavily sandboxed CI with strict rlimits on memory or file descriptors.

Related errors

• LoadCAFile
• HEAD ${url}: ${head.status}
• Range ${url}: ${res.status}
• InvalidCAFile
• InvalidCA

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/b81ca85d9591aa2a. Report an issue: GitHub.