Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• critical

  Auth.js (@auth/core): Email Magic-Link Homoglyph Bypass Leading to Account Takeover

  Auth.js's email sign-in normalizer validates the address before applying Unicode normalization, letting an attacker smuggle a lookalike '@' character to redirect a magic-link to an…

• high

  JupyterLab Image Viewer Stored XSS via Malicious SVG File

  JupyterLab's image viewer passes SVG files directly to a new browser tab without sanitization, letting any embedded JavaScript run in the JupyterLab origin and potentially execute commands on the…

• highCVE-2026-64642

  CVE-2026-64642: Next.js Middleware Bypass via Turbopack Single-Locale i18n

  A flaw in how Next.js Turbopack compiles the middleware route matcher when only one locale is configured lets an attacker prefix any protected path with that locale to skip authentication entirely.

• highCVE-2026-10050

  CVE-2026-10050: Eclipse Jetty Digest Authentication Bypass via ISO-8859-1 Encoding Collision

  Jetty's HTTP client computes Digest authentication hashes using ISO-8859-1, which silently maps any non-Latin-1 character (Chinese, Cyrillic, emoji, etc.) to the byte 0x3F, letting an attacker log in…

• highCVE-2024-7708

  CVE-2024-7708: Eclipse Jetty jetty-server Buffer Leak DoS via 100-Continue Requests

  Sending repeated HTTP requests with an Expect: 100-continue header causes Jetty to silently leak a read buffer per request, allowing any unauthenticated attacker to exhaust server memory and cause a…

• highCVE-2026-64645

  CVE-2026-64645: Next.js Server-Side Request Forgery via Rewrite Destination Hostname

  A Next.js rewrite or redirect rule that builds its destination hostname from user input can be tricked into proxying requests to any server the attacker controls, exposing internal services and…

• high

  CVE-2026-65016: n8n SSO Instance-Role Provisioning Privilege Escalation to Instance Owner

  When Enterprise SSO role provisioning is enabled, an attacker who controls their IdP's role claim can set it to 'global:owner' and be silently promoted to full instance administrator on login.

• highCVE-2026-56745

  CVE-2026-56745: netty-codec-http SpdyHttpDecoder ByteBuf Reference Leak

  Netty's SPDY-to-HTTP decoder permanently leaks native memory for every stream that is reset or overflows the content limit, letting any remote client exhaust the JVM's direct memory pool and crash…

• highCVE-2026-56822

  CVE-2026-56822: netty-handler-ssl-ocsp TOCTOU Race in OcspServerCertificateValidator

  Netty fires the TLS handshake-success event to downstream handlers before its async OCSP check finishes, letting a client leak sensitive data to a server whose certificate may be revoked.

• highCVE-2026-59901

  CVE-2026-59901: Netty Bzip2Decoder Infinite Loop DoS

  A crafted bzip2 stream can permanently hang the Netty event-loop thread by trapping it in an infinite loop inside the run-length encoding decoder, taking the entire server offline with a single…

• highCVE-2026-59209

  CVE-2026-59209: n8n Shared Credential Header Leak via HTTP Request Pagination Expression

  A low-privileged n8n user with read-only access to a shared workflow can steal API keys and auth tokens injected into HTTP request headers by reading them through a pagination expression, then…

• highCVE-2026-59206

  CVE-2026-59206: n8n Prototype Pollution via Workflow Credentials

  Any authenticated n8n user can poison the shared JavaScript prototype through a crafted workflow, letting unauthenticated callers enumerate every account's email, role, and MFA status.