Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HTTP Request Smuggling due to CR-to-Hyphen conversion#922597	Valid	Injection and Smuggling	–	2020-10-17	–	134
Improper HTTP header block termination in llhttp#2054283	Valid	Injection and Smuggling	Medium	2025-06-13	–	122
HTTP request smuggling using malformed Transfer-Encoding header#735748	Valid	Injection and Smuggling	–	2020-03-07	–	105
HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser#3723248	Valid	Injection and Smuggling	Medium	2026-07-31	–	49
Http request splitting#409943	Valid	Injection and Smuggling	–	2020-01-15	–	45
Potential HTTP Request Smuggling in nodejs#1002188	Valid	Injection and Smuggling	–	2021-01-07	$250	34
Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line#3648681	Valid	Injection and Smuggling	Medium	2026-07-01	–	30
Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat#3688064	Valid	Injection and Smuggling	High	2026-06-25	–	18
HTTP Request Smuggling via Content Length Obfuscation#2237099	Valid	Injection and Smuggling	–	2024-05-03	–	18
HTTP Request Smuggling due to accepting space before colon#1238709	Valid	Injection and Smuggling	–	2021-10-20	$250	18
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser#3564941	Valid	Injection and Smuggling	Low	2026-08-28	–	16
CRLF Injection in Nodejs ‘undici’ via host#1820955	Valid	Injection and Smuggling	–	2023-02-22	–	11
HTTP Request Smuggling Due To Improper Delimiting of Header Fields#1524692	Valid	Injection and Smuggling	–	2022-07-07	–	9
HTTP Request Smuggling via Empty headers separated by CR#2001873	Valid	Injection and Smuggling	–	2023-06-20	–	8
HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding#1524555	Valid	Injection and Smuggling	–	2022-07-07	–	7
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding#1501679	Valid	Injection and Smuggling	–	2022-07-07	–	7
HTTP Request Smuggling due to ignoring chunk extensions#1238099	Valid	Injection and Smuggling	–	2021-11-02	$250	7
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields#1675191	Valid	Injection and Smuggling	–	2022-10-26	–	6
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)#1665156	Valid	Injection and Smuggling	–	2022-10-26	–	6
CVE-2022-32213 bypass via obs-fold mechanic#1630336	Valid	Injection and Smuggling	–	2022-10-26	–	5
CRLF Injection in legacy url API (url.parse().hostname)#771596	Informative	Injection and Smuggling	–	2020-01-10	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.