Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Vulnerability in http-parser & embedded NULL header handling#536954	Valid	Memory Corruption	–	2020-02-13	–	1
Use After Free in crypto.randomFill#340053	Informative	Memory Corruption	–	2020-01-15	–	2
Out of order TLS handshake / application data messages lead to segmentation fault#335495	Valid	Memory Corruption	–	2020-02-13	–	3
Denial of Service: nghttp2 use of uninitialized pointer#335608	Valid	Memory Corruption	–	2020-02-13	–	4
`fs.realpath.native` on darwin may cause buffer overflow#965914	Valid	Memory Corruption	–	2020-10-17	–	4
Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals.#1141623	N/A	Memory Corruption	–	2021-06-14	–	4
Improper handling of untypical characters in domain names#1178337	Valid	Memory Corruption	–	2021-09-10	–	4
OOB read in libuv#1209681	Valid	Memory Corruption	–	2021-07-05	–	5
HTTP/2 Denial of Service Vulnerability#335533	Valid	Memory Corruption	–	2020-02-13	–	6
napi_get_value_string_X allow various kinds of memory corruption#784186	Valid	Memory Corruption	–	2020-07-02	$250	7
Your page has 2 blocking CSS resources. This causes a delay in rendering your page.#365968	N/A	Memory Corruption	–	2018-07-15	–	8
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)#3760016	Valid	Memory Corruption	High	2026-06-25	–	13
Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2#3833629	Valid	Memory Corruption	High	2026-08-28	–	17
Take over subdomain undici.nodejs.org.cdn.cloudflare.net#1763817	Valid	Memory Corruption	Medium	2023-01-11	–	22
Null Dereference in X509ToObject#3824331	Valid	Memory Corruption	Medium	2026-10-23	–	22
Node.js: use-after-free in TLSWrap#988103	Valid	Memory Corruption	–	2021-01-05	–	27
Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled#3405778	Valid	Memory Corruption	High	2026-02-12	–	43
NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset#3736889	Informative	Memory Corruption	High	2026-05-23	–	44
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.#3083428	Valid	Memory Corruption	Low	2025-05-15	–	59

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.