Nightjarhttps://nightjar.blog/2026-08-24T15:51:08ZSlipping an extra request through Cloudflare Pingora on a close-delimited bodytag:nightjar.blog,2026:pingora-request-smuggling2026-06-07T09:00:00ZPingora could not recognise a comma-separated Transfer-Encoding, so it read the request body until the socket closed.Same digest, different files: ZIP parser differentials in uv and piptag:nightjar.blog,2026:uv-zip-parser-disagreement2026-05-01T09:00:00ZA ZIP with one digest that expands into two different packages depending on which installer opens it.Overflowing the DjVuLibre MMR decoder with zero-length runstag:nightjar.blog,2026:djvulibre-scanruns2026-03-25T09:00:00ZA fax-coding decoder writes one run-length entry per code and never checks it is still inside the buffer.A request header made Next.js cache private per-user responsestag:nightjar.blog,2026:nextjs-cache-poisoning2026-02-16T09:00:00ZOne internal header flips an SSR response into an SSG one, and the Cache-Control header follows it.Escaping a root directory with Windows device paths in Go's path/filepathtag:nightjar.blog,2026:go-windows-path-handling2026-01-10T09:00:00ZGo's path cleaner did not know that \??\c:\x is another spelling of c:\x, and the fix for that needed a fix of its own.Out-of-bounds write in libcue from a negative INDEX numbertag:nightjar.blog,2025:libcue-track-index2025-12-04T09:00:00Zatoi has no way to report failure, and track_set_index only checked one end of the array.What does the Squid request smuggling patch actually fix?tag:nightjar.blog,2025:squid-chunked-parsing2025-10-28T09:00:00ZThe advisory says 'chunked decoder lenience' and stops; the commit says 0x prefixes, bare LFs and a bad rewind point.Type confusion in OpenSSL's X.400 address handling (CVE-2023-0286)tag:nightjar.blog,2025:openssl-x400-type-confusion2025-09-21T09:00:00ZA public header said ASN1_TYPE, the ASN.1 template produced an ASN1_STRING, and one comparison function stood between the two.Traversing a path into the Home Assistant Supervisor API without a tokentag:nightjar.blog,2025:home-assistant-supervisor-auth2025-08-15T09:00:00ZAn unauthenticated allow-list matched a string while a proxy client normalised a path, three times in a row.A second root element: SAML signature bypass in passport-samltag:nightjar.blog,2025:passport-saml-signature-bypass2025-07-09T09:00:00ZAn XML signature covers an element, not a file, and passport-saml picked its element two different ways.Non-responsive delegation: CPU exhaustion in Unbound and BIND 9 resolverstag:nightjar.blog,2025:nrdelegation-resolver-attack2025-06-02T09:00:00ZThe referral cap everyone added after NXNSAttack turns into a loop when the nameservers exist but never answer.Pointing Cargo's .cargo-ok write at a file outside the crate directorytag:nightjar.blog,2025:cargo-crate-extraction2025-04-26T09:00:00ZCargo wrote "ok" into a marker file after unpacking a crate, and the crate got to decide what that marker was.Turning a 27-byte IP fragment into an arbitrary write in U-Boottag:nightjar.blog,2025:uboot-ip-defragmentation2025-03-20T09:00:00ZU-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.Proof of nothing: TLS 1.3 authentication bypasses in wolfSSLtag:nightjar.blog,2025:wolfssl-state-machine2025-02-11T09:00:00ZHow a black-box state machine learner found two ways to skip the only part of TLS 1.3 that proves who you are.Space in a token: request smuggling in mitmproxy's HTTP/1.1 parsertag:nightjar.blog,2025:mitmproxy-request-smuggling2025-01-05T09:00:00Zmitmproxy split header lines on the first colon and kept whatever came before it, whitespace included.Namespace separator injection in libexpat (CVE-2022-25236)tag:nightjar.blog,2024:expat-namespace-separator2024-11-29T09:00:00Zlibexpat packed three strings into one buffer with a delimiter you chose, and never checked whether the delimiter turned up in the data.Last write wins: an ext_authz authorization bypass in Envoytag:nightjar.blog,2024:envoy-ext-authz-bypass2024-10-23T09:00:00ZEnvoy packed request headers for its external authorizer into a protobuf map, so a repeated header arrived with only its last value.Reflected public keys: recovering the six digits of Bluetooth Passkey Entrytag:nightjar.blog,2024:bluetooth-passkey-reflection2024-09-16T09:00:00ZBluetooth Passkey Entry spends a bit of the passkey per round so it can never be brute-forced offline. Reflect the initiator's public key back at it and it hands over one bit per round instead.Arbitrary file write in node-tar through a stale directory cachetag:nightjar.blog,2024:node-tar-path-normalisation2024-08-10T09:00:00Znode-tar skipped a symlink check whenever its directory cache said the path was fine, and two ways of spelling a path could make the cache lie.Running commands from RDoc by starting a filename with a pipetag:nightjar.blog,2024:rdoc-command-injection2024-07-04T09:00:00ZRDoc sniffed the first hundred bytes of any file called 'tags' to see whether it was a ctags index, and used the one Ruby function that treats a leading pipe as a command.Python's parse_qsl treated semicolons as separators, enabling web cache poisoningtag:nightjar.blog,2024:python-parse-qsl-semicolon2024-05-28T09:00:00ZA standard-library parser that separated parameters on ';' as well as '&', and the cache poisoning that followed when the proxy in front disagreed.A fifth length byte: integer overflow and a signed syscall compare in Zephyr RTOStag:nightjar.blog,2024:zephyr-mqtt-syscall2024-04-21T09:00:00ZA greater-than that should have been a greater-than-or-equal lets a remote MQTT packet pick any 32-bit length it likes, and a signed branch instruction lets a user thread pick any function pointer it…Half-blind: SSRF in Kubernetes dynamic provisioning via StorageClass parameterstag:nightjar.blog,2024:kubernetes-ssrf-storageclass2024-03-15T09:00:00Zkube-controller-manager will connect to any address you write into a StorageClass, and until 2020 it read the response back to you in a PersistentVolumeClaim event.Smuggling requests past HAProxy with a vertical tab in Transfer-Encodingtag:nightjar.blog,2024:haproxy-vertical-tab-smuggling2024-02-07T09:00:00ZHow a vertical tab in a Transfer-Encoding header made HAProxy and its backend disagree about where a request ended, opening an HTTP request smuggle.Who asked for this file? Previous mode confusion in Windows kernel driverstag:nightjar.blog,2024:windows-access-mode-mismatch2024-01-01T09:00:00ZWindows stores one previous-access-mode value per thread and uses it to answer two unrelated questions, and the workaround for that leaks straight into driver code.