Node.js · disclosed reports
Access Control
33 disclosed reports · $500 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Node.js on HackerOne- reports
- 33
- paid a bounty
- 1
Every one of the 33 is a mark on the map. Named now: 1 to 26, most upvoted first.
- WASI sandbox escape via symlink
- Worker permission bypass via InternalWorker leak in diagnostics
- Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
- Permission model improperly processes UNC paths
- fs.futimes() Bypasses Read-Only Permission Model
- Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
- Permission Model Bypass via `process.report.writeReport()` Path Misvalidation
- setuid() does not drop all privileges due to io_uring
- Code injection and privilege escalation through Linux capabilities
- Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
- fs.fchown/fchmod bypasses permission model
- Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes
- Improper handling of wildcards in --allow-fs-read and --allow-fs-write
- dns.resolve truncates names containing NUL char
- fs.lstat bypasses permission model
- Bypass network import restriction via data URL
- DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
- Permission Model bypass with fs.realpathSync
- Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`
- Node Installer Local Privilege Escalation
- Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
- The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1
- Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
- CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown
- Permissions policies can be bypassed via process.mainModule
- Permission Model filesystem over-grant via wildcard radix lookup
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.