Node.js · disclosed reports
Cryptography
19 disclosed reports · $150 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Node.js on HackerOne- reports
- 19
- paid a bounty
- 1
Every one of the 19 is a mark on the map. Named now: 1 to 19, most upvoted first.
- HashDoS in V8
- Improper error handling in async cryptographic operations crashes process
- registry.nodejs.org Subdomain Takeover
- TLS certificate hostname bypass when the IP is written fullwidth digits
- Node.js: TLS session reuse can lead to hostname verification bypass
- TLS certificate hostname bypass when the host loosely resolves to an IP address
- Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling
- Usage of unsafe random function in undici for choosing boundary
- Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation
- HashDoS in V8
- Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery
- Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)
- Remotely trigger an assertion on a TLS server with a malformed certificate string
- Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
- Weak randomness in WebCrypto keygen
- Multiple OpenSSL error handling issues in nodejs crypto library
- Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy
- Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS
- Node.js Certificate Verification Bypass via String Injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.