Nguyen Huu Minh Sang

Discovered and responsibly disclosed a valid security vulnerability on the Enjin blockchain gaming platform, resulting in a rewarded bug bounty.

Second distinct vulnerability reported and triaged on the Enjin program with confirmed security impact assessment.

Discovered and responsibly disclosed an authorization bypass in @fastify/auth, the official Fastify auth-composition plugin (~420K weekly npm downloads). The composition engine stored its verdict in a single mutable currentError field that later callbacks overwrote unconditionally, so a nested AND/OR group's result was masked by whichever function ran last — a request satisfying neither side of the documented expression was authorized with 200 instead of 401. Two configurations affected, including plain { relation: 'and' } with a nested OR group on default options. Submitted a working proof of concept across both cases; fixed in 5.1.1 by latching group verdicts and short-circuiting a failing group.

Independently discovered and responsibly disclosed the column-name injection in the node-mssql SQL Server client (~1.65M weekly npm downloads). Table.declare() interpolated column names straight into CREATE TABLE DDL as [name] without doubling embedded ], so a name sourced from an uploaded CSV/XLSX header could close the quoted identifier and append arbitrary stacked T-SQL to the batch run by bulk({ create: true }). Submitted a working proof of concept and a patch; the coordinated fix now rejects unescaped identifiers (EINJECT) across parameter, column, type and procedure names.

Discovered and responsibly disclosed a fail-open authorization flaw in the openapi-backend npm package (≤ 5.17.0). Security handlers returning a truthy error object with additional properties were incorrectly treated as authorization success, allowing unauthenticated requests to reach protected operations. Patched in 5.18.0 by treating any truthy error value as failed authorization.

Reported a code injection flaw in fast-json-stringify, the serializer behind Fastify’s response path (~18M weekly npm downloads). Property names taken from a JSON schema were emitted into the generated serializer source without neutralisation, so a schema reachable from untrusted input could run attacker-controlled JavaScript in the host process. Submitted with a working proof of concept against ≤ 7.0.0. Fastify’s threat model treats schemas as trusted input, so the advisory was not accepted; the property-name escaping was nonetheless corrected upstream in 7.1.0.

Reported a server-side request forgery in probe-image-size (~7M weekly npm downloads), a library whose documented entry point fetches a caller-supplied image URL. The fetch applied no containment against internal network destinations. Submitted with a working proof of concept. The maintainers did not accept the advisory. Details held back, as no fixed release has shipped.

Further vulnerabilities reported to open-source maintainers — awaiting vendor confirmation and coordinated public disclosure.