/
← Voltar ao feed
high technology

Hacktron AI audit finds critical flaws in Cloudflare's vibe-coded Next.js replacement vinext: session leakage, cache poisoning, middleware bypass

1 fonte(s) · 1 atualização(ões) · publicado 26/02/2026 21:00 · coletado há 4 dias

Researcher Mohan Pedhapati of Hacktron ran an AI-driven audit against vinext, Cloudflare's Next.js reimplementation reportedly built in a week with AI assistance. The scan produced 45 findings, of which 24 were manually validated, including several Critical issues. The most serious bugs allow cross-user session data leakage, shared cache poisoning of authenticated responses, authentication bypass of middleware via double URL-encoding, and silent exclusion of /api routes from middleware. Per the author, Cloudflare patched the issues on GitHub after reports via security@, HackerOne and GitHub. Vercel's security team independently flagged some of the same bugs. The article does not report in-the-wild exploitation or CVE assignments.

Detalhes técnicos

  • Session leakage (race condition): vinext used Node's AsyncLocalStorage.enterWith() instead of run(). On Cloudflare Workers, enterWith() is unavailable, so getStore() returns undefined and every request falls back to one shared _fallbackState object. Concurrent requests can read each other's headers()/cookies(), exposing session cookies, search params and cached admin data to other users.
  • Cache poisoning: the patched fetch cache key (buildFetchCacheKey) includes URL, method and body but not the Authorization or Cookie headers. The first user's response is served to every other user on the isolate. Next.js has an undocumented heuristic that opts such requests out of shared caching, and it was not reimplemented.
  • Middleware bypass (parser differential): decodeURIComponent() is called twice in different pipeline stages, and middleware sees the half-decoded path. /%2561dmin bypasses a startsWith('/admin') check but is later decoded to /admin and served. /foo/..%252fadmin achieves the same through path traversal.
  • Image optimizer (/_vinext/image): it runs before middleware and serves the raw file when transformation fails, bypassing access control. It also has an open redirect, because /\example.com passes the check that rejects //, and browsers normalize \ to /.
  • API routes: /api/* is silently excluded from middleware by default, so Next.js-style global auth middleware does not protect API endpoints.
  • Root cause: the author attributes these flaws to AI-generated code optimized to pass functional tests, which do not cover the negative space, concurrency or cross-layer interactions. Security invariants that evolved in Next.js after past incidents were not carried over.

Remediação

  • Update vinext to the patched versions on GitHub and review the fixes for the issues above.
  • Do not rely on middleware alone for authorization. Enforce auth checks inside API routes and handlers.
  • Audit caching of authenticated fetch calls and avoid shared caching of user-specific responses.
  • Test concurrent-request behavior and URL decoding consistency across all pipeline stages before production deployment.

Linha do tempo

  1. hacktron.ai ↗ · pub. 26/02/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Hacktron AI audit finds critical flaws in Cloudflare's vibe-coded Next.js replacement vinext: session leakage, cache poisoning, middleware bypass

    ler a análise desta fonte

    Researcher Mohan Pedhapati of Hacktron ran an AI-driven audit against vinext, Cloudflare's Next.js reimplementation reportedly built in a week with AI assistance. The scan produced 45 findings, of which 24 were manually validated, including several Critical issues. The most serious bugs allow cross-user session data leakage, shared cache poisoning of authenticated responses, authentication bypass of middleware via double URL-encoding, and silent exclusion of /api routes from middleware. Per the author, Cloudflare patched the issues on GitHub after reports via security@, HackerOne and GitHub. Vercel's security team independently flagged some of the same bugs. The article does not report in-the-wild exploitation or CVE assignments.

    Technical Details

    • Session leakage (race condition): vinext used Node's AsyncLocalStorage.enterWith() instead of run(). On Cloudflare Workers, enterWith() is unavailable, so getStore() returns undefined and every request falls back to one shared _fallbackState object. Concurrent requests can read each other's headers()/cookies(), exposing session cookies, search params and cached admin data to other users.
    • Cache poisoning: the patched fetch cache key (buildFetchCacheKey) includes URL, method and body but not the Authorization or Cookie headers. The first user's response is served to every other user on the isolate. Next.js has an undocumented heuristic that opts such requests out of shared caching, and it was not reimplemented.
    • Middleware bypass (parser differential): decodeURIComponent() is called twice in different pipeline stages, and middleware sees the half-decoded path. /%2561dmin bypasses a startsWith('/admin') check but is later decoded to /admin and served. /foo/..%252fadmin achieves the same through path traversal.
    • Image optimizer (/_vinext/image): it runs before middleware and serves the raw file when transformation fails, bypassing access control. It also has an open redirect, because /\example.com passes the check that rejects //, and browsers normalize \ to /.
    • API routes: /api/* is silently excluded from middleware by default, so Next.js-style global auth middleware does not protect API endpoints.
    • Root cause: the author attributes these flaws to AI-generated code optimized to pass functional tests, which do not cover the negative space, concurrency or cross-layer interactions. Security invariants that evolved in Next.js after past incidents were not carried over.

    Remediation

    • Update vinext to the patched versions on GitHub and review the fixes for the issues above.
    • Do not rely on middleware alone for authorization. Enforce auth checks inside API routes and handlers.
    • Audit caching of authenticated fetch calls and avoid shared caching of user-specific responses.
    • Test concurrent-request behavior and URL decoding consistency across all pipeline stages before production deployment.