# Bypassing character blocklists with unicode overflows

DevFeed: [Bypassing character blocklists with unicode overflows](<https://devfeed.tech/articles/bypassing-character-blocklists-with-unicode-overflows-7668.md>)

Original publisher: [Read original article](<https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows>)

Author: Gareth Heyes

Published: 2025-01-28T13:58:28Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [ASCII](<https://devfeed.tech/topics/ascii.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [ascii](<https://devfeed.tech/tags/ascii.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [published](<https://devfeed.tech/tags/published.md>)

## AI overview

The article explains how Unicode codepoint truncation, or Unicode overflow, can bypass character blocklists by producing specific ASCII characters when values exceed byte or JavaScript codepoint limits. It describes active use of these truncation attacks by bug bounty hunters and related tooling added to ActiveScan++, Hackvertor, and Shazzer.

## Source excerpt

Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo