Node.js · disclosed reports
Injection and Smuggling
21 disclosed reports · $750 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Node.js on HackerOne- reports
- 21
- paid a bounty
- 3
Every one of the 21 is a mark on the map. Named now: 1 to 21, most upvoted first.
- HTTP Request Smuggling due to CR-to-Hyphen conversion
- Improper HTTP header block termination in llhttp
- HTTP request smuggling using malformed Transfer-Encoding header
- HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
- Http request splitting
- Potential HTTP Request Smuggling in nodejs
- Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
- Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
- HTTP Request Smuggling via Content Length Obfuscation
- HTTP Request Smuggling due to accepting space before colon
- HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
- CRLF Injection in Nodejs ‘undici’ via host
- HTTP Request Smuggling Due To Improper Delimiting of Header Fields
- HTTP Request Smuggling via Empty headers separated by CR
- HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding
- HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding
- HTTP Request Smuggling due to ignoring chunk extensions
- HTTP Request Smuggling Due to Incorrect Parsing of Header Fields
- HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)
- CVE-2022-32213 bypass via obs-fold mechanic
- CRLF Injection in legacy url API (url.parse().hostname)
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.