Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset#3736889	Informative	Memory Corruption	High	2026-05-23	–	44
Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilledAnalysed#3405778	Valid	Memory Corruption	High	2026-02-12	–	43
Node.js: use-after-free in TLSWrap#988103	Valid	Memory Corruption	High	2021-01-05	–	27
Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2Analysed#3833629	Valid	Memory Corruption	High	2026-08-28	–	17
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)Analysed#3760016	Valid	Memory Corruption	High	2026-06-25	–	13
napi_get_value_string_X allow various kinds of memory corruption#784186	Valid	Memory Corruption	High	2020-07-02	$250	7
HTTP/2 Denial of Service Vulnerability#335533	Valid	Memory Corruption	High	2020-02-13	–	6
Improper handling of untypical characters in domain names#1178337	Valid	Memory Corruption	High	2021-09-10	–	4
Out of order TLS handshake / application data messages lead to segmentation fault#335495	Valid	Memory Corruption	High	2020-02-13	–	3
Vulnerability in http-parser & embedded NULL header handling#536954	Valid	Memory Corruption	High	2020-02-13	–	1

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.