Avishek Sarkar

Security Researcher & Engineer · Cloudflare · Bengaluru

I find vulnerabilities, and build the systems that catch them.

I work across the security lifecycle, from vulnerability research in web frameworks, server runtimes and desktop software to threat modeling and security automation. I build AI-powered review agents, variant analysis pipelines and bug bounty agents that find bugs at scale.

View advisories GitHub
fuzz / coverage map hover to steer
cov 0/0
Credited advisories
5
Critical unauthenticated RCEs
3
Highest CVSS (v4.0)
9.5

Advisories

Coordinated disclosures credited to me, newest first. Select one for details.

  1. One root cause · React Flight deserialization

    1. Unauthenticated RCE in React Server Components ReactGHSA-xqc2-xf4c-x3h3 Critical9.5

      Specially crafted payloads sent to frameworks that support React Server Components could lead to remote code execution, in cases where a response carries multiple typed arrays alongside an attacker-controlled value.

      Packages
      react-server-dom-webpack, -turbopack, -parcel
      Affected
      19.0.0 to 19.0.8, 19.1.0 to 19.1.9, 19.2.0 to 19.2.8, 19.3.0
      Fixed in
      19.0.9, 19.1.10, 19.2.9, 19.3.1
      Severity
      Critical · 9.5 CVSS v4.0
      Credit
      Sole finder
      Read the advisory
    2. Unauthenticated RCE in use cache functions returning typed arrays Next.jsGHSA-673q-mjm6-r5xr Critical9.5

      Applications using the App Router with Cache Components could be exploited for remote code execution when a use cache function returns multiple typed arrays. No workaround exists. The fix shipped in Next.js 16.4.1.

      Package
      next
      Affected
      >= 16.0.0, <= 16.4.0
      Fixed in
      16.4.1
      Weakness
      CWE-502 · Deserialization of untrusted data
      Severity
      Critical · 9.5 CVSS v4.0
      Credit
      Sole finder
      Read the advisory
  2. Unauthenticated RCE on Windows-hosted servers Next.jsCVE-2026-75604 Critical9.0

    Applications using the Pages and App routers without Cache Components could allow remote code execution when the server runs on a Windows filesystem. No workaround exists, so affected deployments needed to upgrade.

    Identifiers
    CVE-2026-75604 · GHSA-p293-qw3h-jr36
    Package
    next
    Affected
    >= 13.4 < 15.5.24, >= 16.0 < 16.3.3
    Fixed in
    15.5.24, 16.3.3
    Weakness
    CWE-22 · Path traversal
    Severity
    Critical · 9.0 CVSS v3.1
    Credit
    Co-reported with @B0RI
    Read the advisory
  3. WebSocket permessage-deflate memory exhaustion Undertow · Red HatCVE-2026-5680 High7.5

    A remote attacker could send crafted WebSocket messages once permessage-deflate is negotiated, driving unbounded allocation in PerMessageDeflateFunction.largerBuffer() and causing denial of service. Mitigated by setting maxDecompressedBufferSize.

    Component
    undertow-core
    Weakness
    CWE-770 · Allocation without limits
    Severity
    Important (Red Hat) · 7.5 CVSS v3.1
    Credit
    Co-reported with Brian Laub
    Read the advisory
  4. Local privilege escalation in Processor Identification Utility IntelCVE-2025-20010 High8.5

    Intel® Processor Identification Utility before 8.0.43 could allow an authenticated local user to escalate privileges. Disclosed in Intel's November 2025 security advisory.

    Identifiers
    CVE-2025-20010 · INTEL-SA-01334
    Fixed in
    8.0.43
    Severity
    High · 8.5 CVSS v4.0 (7.8 v3.1)
    Credit
    Co-reported with Martin Hodo
    Read the advisory

Projects

Open-source security tooling I've built.

  • Krineon

    A multi-agent, evidence-driven harness for authorized source audits. A coordinator dispatches independent research workers through a durable queue, and every result must be replayed by a different agent before it counts. A finding is reported only once full impact is demonstrated.

    • Multi-agent
    • Semantic IR
    • Differential testing
    • Joern · Z3

  • OWASP Agentic Security Dataset

    Machine-readable JSON and YAML built on the OWASP Top 10 for Agentic Applications (2026), with cross-framework mappings and a log of real-world incidents. Use it for threat modeling, detection rules and compliance mapping.

    • Agentic AI
    • Threat modeling
    • OWASP

Writing

Write-ups, tutorials and incident reports.

All posts on Hashnode

Talks

Workshops and masterclasses.

  • · CySecK · IISc Bengaluru

    Reducing the Attack Surface & Improving Defense 

    Session with a live demonstration at the Centre of Excellence for Cybersecurity Karnataka workshop for MSMEs, held for Cybersecurity Awareness Month. Co-presented with Sahil Gupta of Cloudflare.

    • Attack surface
    • Defense
    • Live demo

  • · nasscom · Virtual

    Best Practices for Building a Secure AI Stack 

    Presented a nasscom masterclass on securing AI applications, infrastructure and data, covering AI security risks, governance and privacy, and how organizations get ready to adopt AI safely.

    • AI security
    • Governance
    • Masterclass

About

I'm a security researcher and engineer in Bengaluru, currently a Senior Security Engineer at Cloudflare, and previously at Intel, Dell and HP. I work across the whole life of a vulnerability: finding it, proving its impact, coordinating disclosure, and building the tooling that keeps the same class of bug from coming back.

  • Vulnerability research

    Source audits and exploit development across web frameworks, server runtimes and desktop software.

  • Security automation

    AI-powered code review agents, variant analysis and bug bounty agents that find, validate and triage vulnerabilities at scale.

  • Threat modeling & AppSec

    Threat modeling, design review and code review for web applications and APIs.

  • AI & agentic security

    Multi-agent research harnesses and threat intelligence for agentic systems.

Experience

Over 12 years across product security, offensive research and cloud security.

  1. 2026 to now

    Senior Security Engineer

    Cloudflare · Bengaluru

  2. 2023 to 2026

    Offensive Security Researcher

    Intel Corporation · Bengaluru

Show 3 earlier roles Hide earlier roles
  1. 2018 to 2023

    Principal Product Security Engineer

    Dell EMC · Bengaluru

  2. 2016 to 2018

    Cyber Security

    HP · Bengaluru

  3. 2014 to 2016

    System Engineer

    Tata Consultancy Services · Hyderabad

Education

  1. 2009 to 2013

    B.Tech, Information Technology

    Academy of Technology

Contact

For coordinated disclosure, research collaboration or speaking.