Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakAnalysed#3473882	Valid	Denial of Service	Medium	2026-02-12	–	81
Assertion error in node_url.cc via malformed URL format leads to Node.js crash#3546390	Valid	Denial of Service	Medium	2026-03-26	–	40
Memory leak that enables remote Denial of Service against applications processing TLS client certificates#3357723	Valid	Denial of Service	Medium	2026-02-12	–	34
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors#3658225	Valid	Denial of Service	Medium	2026-06-18	–	33
Denial of Service by resource exhaustion in fetch() brotli decoding#2284065	Valid	Denial of Service	Medium	2024-03-16	–	27
GOAWAY HTTP/2 frames cause memory leak outside heap#2841362	Valid	Denial of Service	Medium	2025-02-06	–	13
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)#3857258	Valid	Denial of Service	Medium	2026-08-28	–	12
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records#3795657	Valid	Denial of Service	Medium	2026-08-28	–	12
Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion#3531737	Valid	Denial of Service	Medium	2026-03-30	–	7
Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames#3676863	Valid	Denial of Service	Medium	2026-06-25	–	4
Fix for CVE-2018-12122 can be bypassed via keep-alive requests#453513	Valid	Denial of Service	Medium	2020-02-13	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.