inzo

always hunting for the unseen;

[inzo @inzo____]

Happy to share my first article with @zhero___, which is also my first CVE (CVE-2025-29927) on the largest JS framework: Next.js.

A critical vulnerability that impacts a wide range of sensitive sectors across the internet.

[zhero; @zhero___]

the research paper is out:

Next.js and the corrupt middleware: the authorizing artifact

result of a collaboration with @inzo____ that led to CVE-2025-29927 (9.1-critical)

https://t.co/GZkbnr6o9H

enjoy the read!

[inzo @inzo____]

@vortex__77 Great work keep pushing forward and achieving great things.

[zhero; @zhero___]

Pleased to publish a browser-related research paper (w/@inzo____) titled:

One trigram at a time: XSLeak via Universal CSS Injection and DoS in Opera (GX)

The title speaks for itself. Enjoy the read!

https://t.co/b7JNGW5Nhm

[zhero; @zhero___]

Paper currently being written. Expected to be the next publication, God willing.

As no companies have yet been found whose vision and values truly align with ours, sponsorships, partnerships, and selective intellectual property transfers related to ongoing and future research remain open for discussion.

[zhero; @zhero___]

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js

https://t.co/0JWjH6yzC2

[zhero; @zhero___]

Now open to sponsorships, partnerships, and selective intellectual property transfers related to ongoing and future research.

Current model: fully independent vulnerability research funded through bug bounty activity, with no consulting or commercial services.

Interested parties can reach out via DM or via the email listed on the blog.

[zhero; @zhero___]

Happy to publish our first research of the year on the SvelteKit framework, downloaded over 800,000 times per week, which led to CVE-2025-67647 (w/@inzo____):

Avoiding the paradox: A native full-read SSRF and one‑shot DoS in SvelteKit

https://t.co/ZhWSK6Ugp3

Enjoy the read

[zhero; @zhero___]

Voting is now open, with three of my papers nominated:

1. Eclipse on Next.js: Conditioned exploitation of an intended race-condition
2. Next.js, cache, and chains: the stale elixir
3. Astro framework and standards weaponization

take a moment to vote!
https://t.co/wqc6YfDsDj

[inzo @inzo____]

No doubt I’ll be voting for these two amazing pieces of research

[zhero; @zhero___]

honored to see two of my research works selected for the initial nominations

they’ve been the most fruitful for me in practice, with ongoing discoveries of vuln assets, incl. several major platforms, and six figures in rewards
If they helped you in any way, consider voting-14/01

[inzo @inzo____]

It was an excellent year of collaboration with my brother, during which I learned many things and we achieved a lot of results.

Find out what next year will bring.

[zhero; @zhero___]

grateful;

[inzo @inzo____]

@zhero___ @h4x0r_dz Avec plaisir 😅

[zhero; @zhero___]

We unfortunately won’t be able to publish our latest paper before the end of 2025 as the maintainers chose to delay it until early January.

Still, it’s been a productive year of zero-day discoveries, with a focus on frameworks, many of which were shared on the blog.

2025 Recap:

[zhero; @zhero___]

second research on Astro, a shorter paper than usual, which led to CVE-2025-64764 (w/ @inzo____):

Unlocking Reflected XSS in the Astro framework

https://t.co/7G90FyCEj2

all applications using the Server Island feature are vulnerable

[e11iptic @e11iptic]

Research from @zhero___ and @inzo____, breaking yet another popular framework. This time, it's @astrodotbuild.

Hackers with character, enjoy the read!

[zhero; @zhero___]

release of our new paper (w/ @inzo____) which resulted in CVE-2025-64525:

Astro framework and standards weaponization

from path-based middleware protection bypass to potential SSRF & XSS + full bypass of CVE-2025-61925 on @astrodotbuild

https://t.co/xTO55gNFu4

[inzo @inzo____]

@zack0x01 @Hacker0x01 I took this one

[inzo @inzo____]

@zhero___ In terms of big influential apps, let's continue:

[zhero; @zhero___]

to echo my last post, your big, influential app with millions of users is surely secure against this

probably the most surprising(?) vulnerability of my short career; sometimes you just need to reach out your arm (almost literally), right @inzo____?

[zhero; @zhero___]

frameworks, frameworks with @inzo____

[inzo @inzo____]

I really enjoyed reading the latest research paper by @albinowax
Big kudos to everyone who contributed to this research
Super inspiring
https://t.co/VzGwkcMjoH

[James Kettle @albinowax]

The whitepaper is live! Learn how to win the HTTP desync endgame... and why HTTP/1.1 needs to die: https://t.co/3vZ2bMx9DA

[inzo @inzo____]

@w_n1rmala Congrats