---
id: 9124
title: "Slacker Slash: Bypassing Bun Security Middleware via Normalization Desync"
source_domain: lab.ctbb.show
source_url: "https://lab.ctbb.show/research/bun-slacker-slash"
published_at: "2026-03-13T00:00:00Z"
tags: ["bun", "auth-bypass", "ctbb", "normalization", "middleware"]
phying_url: "https://phying.com/item/9124"
lang: en
---

# Slacker Slash: Bypassing Bun Security Middleware via Normalization Desync

## Summary

How WHATWG URL compliance in Bun creates a normalization desync with POSIX utilities, enabling double-slash and partial-path middleware bypasses.

## Intelligence Metadata

- **Sources:** lab.ctbb.show
- **Published:** 2026-03-13T00:00:00Z
- **Original:** https://lab.ctbb.show/research/bun-slacker-slash
- **Phying News:** https://phying.com/item/9124