Vercel Turborepo · Disclosed

Alleged Turborepo zero-day offered for sale at $2,500

Nov 05, 2026 · 1 min read

An underground forum post offers an alleged zero-day in Turborepo, Vercel's build tool, for $2,500. The seller claims the flaw steals Vercel Bearer tokens via the Remote Cache mechanism by only manipulating the turbo.json file, rating it CVSS 8.1. No fix has been announced and Vercel has not confirmed the flaw; teams using the turbo package should review turbo.json permissions and rotate tokens pending an official statement.

By HIFY Radar newsroom Updated 11/05/2026 10:29 AM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A seller on an underground forum has offered an alleged zero-day vulnerability in Turborepo, Vercel's build tool, for $2,500. The seller claims the flaw steals Vercel Bearer tokens through the Remote Cache mechanism by manipulating only the turbo.json configuration file. Vercel has not confirmed the flaw and no fix has been announced.

Why it matters

According to the post, the turbo package has about 43 million downloads per week on npm, with cited use at companies such as SAP, JPMorgan Chase, and Disney. The seller says a stolen token enables account takeover via the Vercel API and access to environment variables, including AWS and Stripe keys and database credentials, plus compromise of CI/CD and production deployments. If confirmed, the flaw exposes secrets and development pipelines.

What to do

Watch for an official Vercel statement and updates to the turbo package. Review who can modify turbo.json files in your repositories and restrict those permissions. Rotate Vercel tokens and review sensitive environment variables such as AWS and Stripe keys.

For the technical team

Affected: Vercel Turborepo (pacote npm turbo) · npm package turbo (Turborepo) from Vercel. Affected versions not stated in the announcement.
Exploitation: No exploitation reported and no public PoC. Sale announcement on an underground forum at $2,500, surfaced via dbugs. Severity rated by the seller at CVSS 8.1.
Fix: No fix or mitigation announced in the sources.
Vector: Component: npm package turbo (Turborepo), Remote Cache mechanism. Alleged flaw: theft of Vercel Bearer tokens before build tasks execute. Alleged condition: manipulation of the turbo.json configuration file, with no malicious code execution required.
More details: The seller claims the token enables account takeover via the Vercel API and access to environment variables, including AWS and Stripe keys and database credentials. The post cites about 43 million weekly npm downloads and over 31,000 GitHub stars, and lists SAP, JPMorgan Chase, and Disney as users. Technical details of the flaw were not disclosed.