Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HashDoS in V8Analysed#3131758	Valid	Cryptography	High	2025-07-15	–	53
Improper error handling in async cryptographic operations crashes processAnalysed#2817648	Valid	Cryptography	High	2025-05-14	–	37
registry.nodejs.org Subdomain TakeoverAnalysed#340580	Valid	Cryptography	–	2018-05-04	–	35
TLS certificate hostname bypass when the IP is written fullwidth digitsAnalysed#4038287	Valid	Cryptography	High	2026-10-23	–	29
Node.js: TLS session reuse can lead to hostname verification bypassAnalysed#811502	Valid	Cryptography	High	2020-06-03	–	29
TLS certificate hostname bypass when the host loosely resolves to an IP addressAnalysed#4006744	Valid	Cryptography	High	2026-10-23	–	24
Usage of unsafe random function in undici for choosing boundaryAnalysed#2913312	Valid	Cryptography	Medium	2025-01-23	–	24
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254	Valid	Cryptography	Low	2021-09-10	$150	20
HashDoS in V8#3511792	Valid	Cryptography	Medium	2026-03-30	–	19
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery#3533945	Valid	Cryptography	Medium	2026-03-30	–	16
Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)#2269177	Valid	Cryptography	Medium	2024-02-15	–	16
Remotely trigger an assertion on a TLS server with a malformed certificate string#746733	Valid	Cryptography	Critical	2020-02-06	–	15
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints#3962304	Valid	Cryptography	Medium	2026-10-23	–	13
Weak randomness in WebCrypto keygen#1690000	Valid	Cryptography	High	2022-10-26	–	11
Multiple OpenSSL error handling issues in nodejs crypto library#1808596	Valid	Cryptography	Medium	2023-02-17	–	5
Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy#1583680	Valid	Cryptography	High	2022-07-13	–	4
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS#1695596	Valid	Cryptography	Medium	2022-10-26	–	3
Node.js Certificate Verification Bypass via String Injection#1429694	Valid	Cryptography	Medium	2022-02-10	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.