Featured case · 01
Vercel
Flags SDK · HackerOne (Vercel Open Source)
- Category
- Stateful regular expression
- Recognition
- $400 bounty
- Status
- Resolved
- Date
- Sep 2026
State leaking across flag evaluations
Stage 5/5 · Resolution
Technical overview
Feature flags decide what each request sees, so every evaluation has to be independent of the last. In Vercel's open-source Flags SDK I found a regular-expression flaw that leaked state from one evaluation into the next.
Root cause
Bug class: a stateful regular expression. In JavaScript, a RegExp with the global (g) or sticky (y) flag remembers its lastIndex between calls, so reusing one instance can make the same input match on one call and fail on the next.
Security implications
When a match depends on the previous call, identical inputs can evaluate differently between requests, and any flag decision built on that match becomes unpredictable.
Disclosure process
Reported privately to Vercel together with a recommended fix.
Resolution
Report accepted and resolved. Awarded a $400 bounty.
Proof of conceptwithheld · responsible disclosure
