Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Node.js Certificate Verification Bypass via String Injection#1429694	Valid	Cryptography	–	2022-02-10	–	2
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS#1695596	Valid	Cryptography	–	2022-10-26	–	3
Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy#1583680	Valid	Cryptography	–	2022-07-13	–	4
Multiple OpenSSL error handling issues in nodejs crypto library#1808596	Valid	Cryptography	–	2023-02-17	–	5
Weak randomness in WebCrypto keygen#1690000	Valid	Cryptography	–	2022-10-26	–	11
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints#3962304	Valid	Cryptography	Medium	2026-10-23	–	13
Remotely trigger an assertion on a TLS server with a malformed certificate string#746733	Valid	Cryptography	–	2020-02-06	–	15
Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)#2269177	Valid	Cryptography	–	2024-02-15	–	16
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery#3533945	Valid	Cryptography	Medium	2026-03-30	–	16
HashDoS in V8#3511792	Valid	Cryptography	Medium	2026-03-30	–	19
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254	Valid	Cryptography	–	2021-09-10	$150	20
Usage of unsafe random function in undici for choosing boundary#2913312	Valid	Cryptography	Medium	2025-01-23	–	24
Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling#3463949	Informative	Cryptography	High	2025-12-19	–	24
TLS certificate hostname bypass when the host loosely resolves to an IP address#4006744	Valid	Cryptography	High	2026-10-23	–	24
Node.js: TLS session reuse can lead to hostname verification bypass#811502	Valid	Cryptography	–	2020-06-03	–	29
TLS certificate hostname bypass when the IP is written fullwidth digits#4038287	Valid	Cryptography	High	2026-10-23	–	29
registry.nodejs.org Subdomain Takeover#340580	Valid	Cryptography	–	2018-05-04	–	35
Improper error handling in async cryptographic operations crashes process#2817648	Valid	Cryptography	High	2025-05-14	–	37
HashDoS in V8#3131758	Valid	Cryptography	High	2025-07-15	–	53

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.