Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakAnalysed#3473882	Valid	Denial of Service	Medium	2026-02-12	–	81
Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions#3781015	Informative	Denial of Service	High	2026-06-12	–	41
Assertion error in node_url.cc via malformed URL format leads to Node.js crashAnalysed#3546390	Valid	Denial of Service	Medium	2026-03-26	–	40
Memory leak that enables remote Denial of Service against applications processing TLS client certificatesAnalysed#3357723	Valid	Denial of Service	Medium	2026-02-12	–	34
HTTP/2 sessions never clean up after GOAWAY on invalid protocol errorsAnalysed#3658225	Valid	Denial of Service	Medium	2026-06-18	–	33
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Analysed#3560402	Valid	Denial of Service	High	2026-03-30	–	22
Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)#3857258	Valid	Denial of Service	Medium	2026-08-28	–	12
HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion#3846922	Valid	Denial of Service	High	2026-08-28	–	12
dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records#3795657	Valid	Denial of Service	Medium	2026-08-28	–	12
Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion#3531737	Valid	Denial of Service	Medium	2026-03-30	–	7
Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames#3676863	Valid	Denial of Service	Medium	2026-06-25	–	4

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.