Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
WASI sandbox escape via symlinkAnalysed#2084280	Valid	Access Control	Medium	2025-05-24	–	44
Improper handling of wildcards in --allow-fs-read and --allow-fs-write#2257156	Valid	Access Control	Medium	2024-02-15	–	20
Bypass network import restriction via data URL#2092749	Valid	Access Control	Medium	2024-07-08	–	18
Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`#3559715	Valid	Access Control	Medium	2026-03-30	–	10
Node Installer Local Privilege Escalation#1211160	Valid	Access Control	Medium	2021-07-01	–	10
Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching#3656869	Valid	Access Control	Medium	2026-06-25	–	7
fs.openAsBlob() bypasses permission system#1966492	Valid	Access Control	Medium	2023-07-20	–	6
fs module's file watching is not restricted by --allow-fs-read#1966499	Valid	Access Control	Medium	2023-07-20	–	5
Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings#3656716	Valid	Access Control	Medium	2026-06-25	–	4
OpenSSL engines can be used to bypass and/or disable the permission model#1954535	Valid	Access Control	Medium	2023-06-22	–	4

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.