Preliminary research

FCSC 2026 writeups: Firefox `execCommand` ICU-vs-JS case-folding differential, Gunicorn `HEAd` smuggling, libmagic polyglots

kevin_mizu · mizu.re

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Five CTF web writeups, each a parser disagreement. JavaScript's toLowerCase expands U+0130 to two code points so an execCommand blocklist misses it, while Firefox's u_tolower maps it to plain i and runs insertHTML. Angular ignores matrix params after ';' that Apache counts as real directories, reopening a traversal. DOMPurify lowercases an invalid element name to an allowed tag that JSDOM serialises unescaped, and gunicorn strips a trailing 0x85 byte from Transfer-Encoding where Apache keeps it.

Record

Researcher

kevin_mizu

Published by

mizu.re

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• parser-differential
• request-smuggling
• unicode
• dom-clobbering
• mutation-xss
• xss
• path-traversal
• sanitizer-bypass
• postmessage
• mime
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of kevin_mizu, first published at the original source. Preserved copies are kept so the citation survives its host.