Node.js · disclosed reports
Denial of Service
25 disclosed reports · $1,000 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Node.js on HackerOne- reports
- 25
- paid a bounty
- 4
Every one of the 25 is a mark on the map. Named now: 1 to 25, most upvoted first.
- TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak
- "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
- Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions
- Assertion error in node_url.cc via malformed URL format leads to Node.js crash
- Memory leak that enables remote Denial of Service against applications processing TLS client certificates
- HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
- Denial of Service by resource exhaustion in fetch() brotli decoding
- Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)
- Malformed HTTP/2 SETTINGS frame leads to reachable assert
- GOAWAY HTTP/2 frames cause memory leak outside heap
- http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
- Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
- HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
- dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
- Multiple HTTP/2 DOS Issues
- Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests
- Slowloris, body parsing
- Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion
- Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames
- Regular Expression Denial of Service in Headers
- HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion
- Fix for CVE-2018-12122 can be bypassed via keep-alive requests
- DNS Max Responses for DOS
- Node.js HTTP/2 Large Settings Frame DoS
- Http response is not ended although underlying socket is already destroyed
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.