ClarityBeta

Engineering & Technical

The Engineer

9 min read · 1,705 words · 3 moves to watch
The Signal

Next.js's image optimizer decodes attacker bytes before your auth middleware runs.

The path is /_next/image: sharp hands the payload to libavif and libheif inside the same Node process that holds your database URL and service-account token. That puts preview deploys and the dashboards nobody owns in scope, not just production. Fixes are 16.3.3 and 15.5.24, and only the lockfile tells you whether you're on them.

In Play

  1. Pre-Auth RCE in Next.js, and a Triage Order That Isn't CVSS

    Vercel patched two critical unauthenticated remote-code-execution flaws in Next.js, credited to Hacktron — one reachable through AVIF image handling, one Windows-specific. Only three of the five disclosures in these advisories are fully pre-auth (Next.js, ServiceNow, ZBT routers); cPanel/WHM needs a low-privilege tenant account and PaperCut's precondition is still unknown. Patch latency and blast radius were the only controls that contributed anything.

    Ask Clarity
    Sign in to ask more about this

  2. The Harness Decides the Benchmark Number

    DeepSeek's own harness in minimal mode, an open-source Terminus 2 run by Artificial Analysis, and Vals AI's internal harness all scored the same DeepSeek-V4-Pro-0813 weights and disagreed wildly. Vendor agentic scores tell you nothing about your loop until you re-run them in scaffolding you pinned yourself.

    Ask Clarity
    Sign in to ask more about this

  3. Prompt Cache Misses That Page Nobody

    Anthropic fixed a Claude Code bug in which OAuth token refresh re-rendered tool definitions, silently invalidating the prompt cache. It never errored and never logged, and the only symptom was a higher bill. Cache-hit rate belongs in your SLI set, alerting on periodic dips rather than absolute values.

    Ask Clarity
    Sign in to ask more about this

  4. A localhost Bind Is Not an Auth Boundary

    A DNS rebinding flaw in NemoClaw gives any web page unauthenticated access to its local Ollama server, and instructions planted through it persist into later conversations. Ollama, LM Studio, vLLM dev servers and local MCP servers all bind 127.0.0.1 with no auth by default. CORS does not help: after rebinding the request is same-origin, so no preflight fires. What holds is a Host/Origin allowlist, a bearer token, or moving off TCP to a unix socket.

    Ask Clarity
    Sign in to ask more about this

  5. MCP Grew Actuators, So Tool Schemas Need a Reversibility Field

    Anthropic opened a research preview of Model Hardware Standard, extending the MCP pattern from software tools to microscopes, liquid handlers, robotic arms and laser systems, built with HHMI Janelia and seeded to AWS, Danaher, Universal Robots and Genentech. Nothing in the published description covers authentication, authorization scoping, dry-run or idempotency. The transferable move costs days: add a side-effect tier — read, reversible write, irreversible — to every tool definition you already own.

    Ask Clarity
    Sign in to ask more about this

Deep Dives

  1. The Image Optimizer Runs Inside Your Credential Boundary

    Three of the five disclosures need no credentials and a fourth needs only a low-privilege tenant account, which leaves patch latency and process isolation as the only working controls — and puts PaperCut ahead of a trio of CVSS 10.0s in the queue.

    The chain is short, boring, and ends at the metadata service Next.js's built-in optimizer exposes /_next/image?url=… & w=… & q=… . Behind that route, sharp hands bytes to native decode libraries — libavif, libheif, aom — C and C++ parsing…

    3 action items

    ●

  2. Thirty-Three Points of Spread From the Same Model Weights

    Two knobs pay for the harness work immediately: a reasoning-effort default that doubles token spend for nothing, and a cost tier that is 47x cheaper for eleven points of measured intelligence.

    Minimal mode is a shell plus a file editor Check what produced the top number. The configuration DeepSeek calls minimal mode is a shell and a file editor. The scaffolding that maximizes an agentic benchmark score is the scaffolding with…

    3 action items

    ●

  3. An OAuth Refresh Was Rewriting Your Cached Prefix

    Prompt caching keys on exact bytes, so the auth layer became a billing bug — and the only spend-enforcement point that survives the next integration is the gateway, not application code.

    How prefix drift turns cache hits into misses Prompt caching keys on an exact prefix. Anything upstream that mutates that prefix nondeterministically turns a hit into a miss. In Claude Code the coupling was specific: a side effect of token…

    3 action items

    ●

The edition continues

Take the signal into the room.

Sign up or log in to read all 3 deep dives in full, plus the final take.

Read the full edition

Continue with LinkedIn