Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
CRLF Injection in legacy url API (url.parse().hostname)#771596	Informative	Injection and Smuggling	Medium	2020-01-10	–	2
CVE-2022-32213 bypass via obs-fold mechanic#1630336	Valid	Injection and Smuggling	Medium	2022-10-26	–	5
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)#1665156	Valid	Injection and Smuggling	Medium	2022-10-26	–	6
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields#1675191	Valid	Injection and Smuggling	Medium	2022-10-26	–	6
HTTP Request Smuggling due to ignoring chunk extensions#1238099	Valid	Injection and Smuggling	Medium	2021-11-02	$250	7
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding#1501679	Valid	Injection and Smuggling	Medium	2022-07-07	–	7
HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding#1524555	Valid	Injection and Smuggling	Medium	2022-07-07	–	7
HTTP Request Smuggling via Empty headers separated by CR#2001873	Valid	Injection and Smuggling	Medium	2023-06-20	–	8
HTTP Request Smuggling Due To Improper Delimiting of Header Fields#1524692	Valid	Injection and Smuggling	Medium	2022-07-07	–	9
CRLF Injection in Nodejs ‘undici’ via host#1820955	Valid	Injection and Smuggling	Medium	2023-02-22	–	11
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser#3564941	Valid	Injection and Smuggling	Low	2026-08-28	–	16
HTTP Request Smuggling due to accepting space before colon#1238709	Valid	Injection and Smuggling	Medium	2021-10-20	$250	18
HTTP Request Smuggling via Content Length Obfuscation#2237099	Valid	Injection and Smuggling	Medium	2024-05-03	–	18
Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat#3688064	Valid	Injection and Smuggling	High	2026-06-25	–	18
Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line#3648681	Valid	Injection and Smuggling	Medium	2026-07-01	–	30
Potential HTTP Request Smuggling in nodejs#1002188	Valid	Injection and Smuggling	Low	2021-01-07	$250	34
Http request splitting#409943	Valid	Injection and Smuggling	–	2020-01-15	–	45
HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser#3723248	Valid	Injection and Smuggling	Medium	2026-07-31	–	49
HTTP request smuggling using malformed Transfer-Encoding headerAnalysed#735748	Valid	Injection and Smuggling	Critical	2020-03-07	–	105
Improper HTTP header block termination in llhttpAnalysed#2054283	Valid	Injection and Smuggling	Medium	2025-06-13	–	122
HTTP Request Smuggling due to CR-to-Hyphen conversionAnalysed#922597	Valid	Injection and Smuggling	High	2020-10-17	–	134

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.