Comprehensive research into Client-Side Path Traversal (CSPT) vulnerabilities across 10 modern frontend frameworks, with runnable proof-of-concept labs and detection tooling.

Presented at: Critical Thinking Bug Bounty Podcast (March 19, 2026)

Every modern frontend framework decodes URL parameters before passing them to developer code. When decoded params flow into fetch() calls, the browser normalizes ../ sequences before the HTTP request leaves — creating path traversal that bypasses server-side protections entirely.

Three things that make CSPT universal:

1. No JavaScript encoding function encodes dots. encodeURIComponent('..') === '..' — traversal survives all encoding.
2. fetch() normalizes ../ before sending. fetch('/api/users/../../admin') sends GET /admin. The browser does this, not the framework.
3. Server-side rendering turns CSPT into SSRF. Next.js Server Components, Remix loaders, SvelteKit +page.server.ts — all execute fetch() on the server with internal credentials and network access.

Each framework has a dedicated research directory containing:

Frameworks covered: React Router, Next.js, Vue Router, Nuxt, Angular, SvelteKit, Astro, Ember.js, SolidStart, Remix

Each lab is a real, runnable application demonstrating CSPT in the target framework.

Passive framework detection with client-side path extraction and CSPT sink analysis. Integrates with the Caido HTTP proxy to detect framework fingerprints, extract dynamic route definitions from minified bundles, and identify CSPT source-to-sink chains.

Chrome DevTools panel ("doctorscan") for detecting CSPT patterns directly in the browser. Identifies frameworks, extracts routes, and flags CSPT sources and sinks with per-framework encoding context. No traffic interception required.

• cspt-framework-notes.md — Master reference document (54 KB) covering all frameworks with encoding comparisons, CVEs, and detection patterns
• react-cspt-deep-dive.md — Detailed empirical analysis of React Router v7 encoding behavior with comprehensive encoding matrix

The novel contribution of this research is documenting how each framework's encoding pipeline creates (or prevents) CSPT:

• React Router v7 double-decodes through safelyDecodeURI() + safelyDecodeURIComponent() — %252f becomes /
• Next.js App Router re-encodes page params but leaves route handler params decoded — same framework, different attack surface
• SolidStart doesn't decode params at all — defense-in-depth by default
• Astro uses decodeURI() instead of decodeURIComponent() — %2F preserved, but encoded letters decode (CVE-2025-64765)
• Vue Router has the cleanest exploit: route.params decoded, route.path encoded — consistent and reliable

When CSPT occurs in SSR contexts, it becomes SSRF with internal credentials:

• Remix loaders execute fetch() with server-side auth headers and internal network access
• SvelteKit +page.server.ts load functions run on the server
• Next.js route handlers and Server Components fetch with full server privileges
• Nuxt server routes via H3 have access to internal services

Each lab is a standalone application. Install dependencies and start the dev server:

# Example: React lab
cd react-cspt-lab
bun install
bun run dev

# Example: Next.js lab
cd nextjs-cspt-lab
bun install
bun run dev

Build to production to test detection against minified/bundled code:

bun run build

xssdoctor — Offensive security researcher specializing in client-side vulnerabilities

This research is provided for educational and authorized security testing purposes only.