A URL validator approves one representation; resolution, redirects and authority emission can each replace it after the check. I ran a differential oracle across eight languages: sixteen validators against five clients, 1,855 verdicts, then looked for those disagreements in shipped code. Mealie checked the A record and dialled AAAA; changedetection.io’s backslash-`@` reached live IMDS.

Some were fixed. Others came back duplicate or won’t-fix, and a few I never reported.

The raw measurements and negative results behind The Validator Can Lie: fourteen pinned URL parsers across eight languages, and the bug families indexed by the pipeline stage where two components can legally disagree. One oracle run emits 1,855 verdicts over sixteen validators and five clients.

Eight of the fifteen families have a product finding. The map separately ranks fifteen gap cells and publishes them as open problems.

I tested four AI-assisted vulnerability-research workflows over roughly one week. The strongest run found 14 confirmed bugs in one target in 20 minutes; another approach produced many parser bugs but nothing I could report as a vulnerability. Across all four, the models were useful for coverage, hypothesis generation, and code analysis, but consistently overstated impact and produced unreliable validation. I still had to verify each finding and build every exploitable chain manually.

Between December 2025 and January 2026 I found three request-smuggling bugs in Cloudflare’s Pingora and one cache-poisoning bug: `CacheKey::default()` keys on the URI path alone, so evil.com and victim.com share a cache entry for the same path. All four work under Pingora’s default configuration.

Cloudflare’s own CDN stack sits behind upstream layers; direct Pingora deployments are exposed. Fixed in Pingora 0.8.0, $5,000 in bounties.

I went looking for sanitizer bypasses to harden a CTF challenge, and found one in sanitize-html. htmlparser2 parses everything inside `<style>` as raw text, so `<math><style><img/src=x onerror="alert(1)"` passes through; the browser then closes both tags per HTML5 and leaves a live `img` with the handler attached.

It needs `style` and `math` in `allowedTags`; the library already warns about `style`. At the time of testing, v2.13.1 still behaved this way.

Nodemailer’s address parser splits at the first `@` outside a properly recognized quoted local-part, so `"test@0xhexr4.htb"@google.com` loses `google.com` as its domain. I found that first case while building a CTF challenge; Nodemailer called it a regular bug and fixed it in v6.9.16 without credit.

A second payload, `"xclow3n@gmail.com x"@internal.domain`, routed to gmail.com instead. I reported that one as a security advisory, GHSA-mm7p-fcc7-pg87, patched in v7.0.7.

The intended solution to my Intergalactic Bounty challenge from HTB University CTF 2024, in four stages. A Nodemailer parser discrepancy gets past a registration gate that only accepts interstellar.htb, then MXSS through sanitize-html with `math`, `style` and `svg` allowed steals the admin cookie.

From there a `mergedeep` prototype pollution sets needle’s `output` option to overwrite a template file, and a crash-restart runs it as RCE.

My intended solution to EncoDecept, HTB University CTF 2024. The challenge’s Nginx caches by file extension and Rails treats `.` as a path delimiter, so `/settings.ico` poisons the cache. With no charset declared, a JIS X 0208 1978 differential turns a markdown bio into XSS in Chrome.

Running as `contract_manager`, a Django ORM leak brute-forces the admin password, then a controller merging request params over its `Marshal` payload gives RCE.