Bug bounty program · HackerOne
Most upvoted reports154
- #922597ValidHTTP Request Smuggling due to CR-to-Hyphen conversionNode.js · Injection and Smuggling · 2020–134votes
- #2054283ValidImproper HTTP header block termination in llhttpNode.js · Injection and Smuggling · 2025 · Medium–122votes
- #735748ValidHTTP request smuggling using malformed Transfer-Encoding headerNode.js · Injection and Smuggling · 2020–105votes
- #3473882ValidTLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakNode.js · Denial of Service · 2026 · Medium–81votes
- #2319584Valid"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashNode.js · Denial of Service · 2024–65votes
- #2307225ValidPath traversal by drive name in Windows environmentNode.js · File and Path Handling · 2025 · Medium–59votes
- #3083428ValidCorrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · Memory Corruption · 2025 · Low–59votes
- #3556769ValidIncomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSNode.js · No weakness recorded · 2026 · High–59votes
- #3302484InformativeCWE-195 in ExternalMemoryAccounter::Increase()Node.js · No weakness recorded · 2025–55votes
- #3131758ValidHashDoS in V8Node.js · Cryptography · 2025 · High–53votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.