Hacktron finds 24 flaws in AI-built vinext, 4 critical

Hacktron, a company that sells AI-driven security testing, pointed its agent at vinext as soon as Cloudflare announced it. vinext is a replacement for the Next.js web framework that one engineer built with AI in about a week. The write-up explains why the author expected trouble. vinext was produced by having a model write code until it passed tests, and those tests describe how the framework should behave. Vulnerabilities live in the behavior nobody wrote a test for, especially where separate layers interact. Next.js has fixed many of its own security problems after earlier incidents, but those fixes do not carry over to a fresh reimplementation. The agent returned 45 findings. After dropping low-severity issues and false positives, the author manually validated 24: 4 critical, 7 high, 8 medium, 3 low and 2 informational. An October 6 post on X points back to the write-up and says Cloudflare patched them.

The worst bug shows the pattern. Vite runs two parts of page rendering in separate sandboxes that cannot share variables, so vinext passed per-request data between them using Node's AsyncLocalStorage, a facility that keeps values tied to one request as it moves through asynchronous code. It can isolate each request, or it can simply stamp data onto whatever is currently running. The model chose the simpler option, and every test passed because the tests send one request at a time. On Cloudflare Workers that option is unavailable, so every request fell back to a single shared object. Whenever one request paused to wait on something, the next request overwrote that object. When the first request resumed and read its cookies, it got the second user's session. Hacktron's proof of concept fires paired requests with different session cookies at once, then checks whether each user's page contains the other's data, which the write-up says it did.

Other high-severity findings come from the same gap between passing behavior and safe behavior. vinext's fetch cache built its key from the URL, method and body but not the Authorization or Cookie headers, so the first user's profile could be served to everyone. The write-up says Next.js avoids this through an undocumented rule that grew out of production incidents. In another flaw, vinext decoded the URL at two different stages and ran middleware in between. A request for /%2561dmin looked like /%61dmin to authentication middleware checking for /admin, so the check never ran, and the router then fully decoded the path and served the protected page. vinext also silently skipped middleware on /api routes by default, so global auth middleware written for Next.js would leave every API endpoint unprotected.

This is a vendor's own account of its own tool, and the author qualifies it. Many findings share root causes, a few are code-quality issues, and the model often mislabeled severity, though the author calls the four critical bugs genuinely critical and says a human still had to judge which findings mattered. Vercel's security team independently flagged some of the same bugs. The author reported through security@, HackerOne and GitHub, got no acknowledgement on GitHub or HackerOne, and says the issues were fixed on GitHub. The author also argues that first versions written by humans are just as fragile. The audit targeted the week-old release. Cloudflare's later vinext 1.0 announcement is a different version that this write-up does not test.