Node.js · disclosed reports
Memory Corruption
19 disclosed reports · $250 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Node.js on HackerOne- reports
- 19
- paid a bounty
- 1
Every one of the 19 is a mark on the map. Named now: 1 to 19, most upvoted first.
- Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.
- NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset
- Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled
- Node.js: use-after-free in TLSWrap
- Null Dereference in X509ToObject
- Take over subdomain undici.nodejs.org.cdn.cloudflare.net
- Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2
- Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)
- Your page has 2 blocking CSS resources. This causes a delay in rendering your page.
- napi_get_value_string_X allow various kinds of memory corruption
- HTTP/2 Denial of Service Vulnerability
- OOB read in libuv
- Improper handling of untypical characters in domain names
- Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals.
- `fs.realpath.native` on darwin may cause buffer overflow
- Denial of Service: nghttp2 use of uninitialized pointer
- Out of order TLS handshake / application data messages lead to segmentation fault
- Use After Free in crypto.randomFill
- Vulnerability in http-parser & embedded NULL header handling
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.