Findings

Public findings with proof.

Each case includes the exploit path, the impact, and the fix.

8 public findings · Proof and remediation included

Severity

Platform

Year

SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync

RSC reply decoder DoS via $K FormData amplification (CVE-2026-23864)

Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)

Authentication bypass on FastMCP custom routes

SQL Injection via queueName in getDatabaseQueuesMetrics

Exponential merge keys in Bun's YAML implementation leads to DoS

0-click Account Takeover and Admin Operations via helper endpoint authorization bypass

Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions