Writeups
Security vulnerability writeups and research.
high / React /
A Single POST Freezes Any Next.js Server
To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.
critical / n8n /
From a Schema Name to RCE in n8n
n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node.
high / h3 /
One Uppercase Letter Breaks Every Nuxt App
h3 powers every Nuxt app but only recognized 'chunked' in lowercase. Send 'ChunKed' instead and you get request smuggling.
critical / Tolgee /
Reading /etc/passwd via Translation Upload in Tolgee
Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.