Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessDenial of Service
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
25 of 15,219 reports · $1,000 in bounties · 161 analysed so far
- #3473882ValidTLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakNode.js · Denial of Service · 2026 · Medium–81votes
- #2319584Valid"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashNode.js · Denial of Service · 2024–65votes
- #3781015InformativeIncomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsNode.js · Denial of Service · 2026 · High–41votes
- #3546390ValidAssertion error in node_url.cc via malformed URL format leads to Node.js crashNode.js · Denial of Service · 2026 · Medium–40votes
- #3357723ValidMemory leak that enables remote Denial of Service against applications processing TLS client certificatesNode.js · Denial of Service · 2026 · Medium–34votes
- #3658225ValidHTTP/2 sessions never clean up after GOAWAY on invalid protocol errorsNode.js · Denial of Service · 2026 · Medium–33votes
- #2284065ValidDenial of Service by resource exhaustion in fetch() brotli decodingNode.js · Denial of Service · 2024–27votes
- #3560402ValidDenial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Node.js · Denial of Service · 2026 · High–22votes
- #800140ValidMalformed HTTP/2 SETTINGS frame leads to reachable assertNode.js · Denial of Service · 2020$25014votes
- #2841362ValidGOAWAY HTTP/2 frames cause memory leak outside heapNode.js · Denial of Service · 2025 · Medium–13votes
- #2233486Validhttp: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacksNode.js · Denial of Service · 2024–13votes
- #3857258ValidReachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)Node.js · Denial of Service · 2026 · Medium–12votes
- #3846922ValidHTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustionNode.js · Denial of Service · 2026 · High–12votes
- #3795657Validdns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A RecordsNode.js · Denial of Service · 2026 · Medium–12votes
- #589739ValidMultiple HTTP/2 DOS IssuesNode.js · Denial of Service · 2019–9votes
- #868834ValidDenial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requestsNode.js · Denial of Service · 2020$2508votes
- #799072ValidSlowloris, body parsingNode.js · Denial of Service · 2020$2508votes
- #3531737ValidMemory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustionNode.js · Denial of Service · 2026 · Medium–7votes
- #3676863ValidUnbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN framesNode.js · Denial of Service · 2026 · Medium–4votes
- #1784449ValidRegular Expression Denial of Service in HeadersNode.js · Denial of Service · 2023–3votes
- #1043360ValidHTTP2 'unknownProtocol' cause Denial of Service by resource exhaustionNode.js · Denial of Service · 2021–3votes
- #453513ValidFix for CVE-2018-12122 can be bypassed via keep-alive requestsNode.js · Denial of Service · 2020–3votes
- #1033107ValidDNS Max Responses for DOSNode.js · Denial of Service · 2020$2502votes
- #446662ValidNode.js HTTP/2 Large Settings Frame DoSNode.js · Denial of Service · 2020–2votes
- #676710InformativeHttp response is not ended although underlying socket is already destroyedNode.js · Denial of Service · 2020–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.