Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak#3473882	Valid	Denial of Service	Medium	2026-02-12	–	81
"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash#2319584	Valid	Denial of Service	–	2024-04-08	–	65
Assertion error in node_url.cc via malformed URL format leads to Node.js crash#3546390	Valid	Denial of Service	Medium	2026-03-26	–	40
Memory leak that enables remote Denial of Service against applications processing TLS client certificates#3357723	Valid	Denial of Service	Medium	2026-02-12	–	34
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors#3658225	Valid	Denial of Service	Medium	2026-06-18	–	33
Denial of Service by resource exhaustion in fetch() brotli decoding#2284065	Valid	Denial of Service	–	2024-03-16	–	27
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)#3560402	Valid	Denial of Service	High	2026-03-30	–	22
Malformed HTTP/2 SETTINGS frame leads to reachable assert#800140	Valid	Denial of Service	–	2020-07-03	$250	14
GOAWAY HTTP/2 frames cause memory leak outside heap#2841362	Valid	Denial of Service	Medium	2025-02-06	–	13
http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks#2233486	Valid	Denial of Service	–	2024-02-15	–	13
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)#3857258	Valid	Denial of Service	Medium	2026-08-28	–	12
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion#3846922	Valid	Denial of Service	High	2026-08-28	–	12
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records#3795657	Valid	Denial of Service	Medium	2026-08-28	–	12
Multiple HTTP/2 DOS Issues#589739	Valid	Denial of Service	–	2019-08-16	–	9
Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests#868834	Valid	Denial of Service	–	2020-10-17	$250	8
Slowloris, body parsing#799072	Valid	Denial of Service	–	2020-10-17	$250	8
Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion#3531737	Valid	Denial of Service	Medium	2026-03-30	–	7
Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames#3676863	Valid	Denial of Service	Medium	2026-06-25	–	4
Regular Expression Denial of Service in Headers#1784449	Valid	Denial of Service	–	2023-03-19	–	3
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion#1043360	Valid	Denial of Service	–	2021-03-15	–	3
Fix for CVE-2018-12122 can be bypassed via keep-alive requests#453513	Valid	Denial of Service	–	2020-02-13	–	3
DNS Max Responses for DOS#1033107	Valid	Denial of Service	–	2020-12-16	$250	2
Node.js HTTP/2 Large Settings Frame DoS#446662	Valid	Denial of Service	–	2020-07-02	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.