Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Null Dereference in X509ToObjectAnalysed#3824331 | Valid | Memory Corruption | Medium | 2026-10-23 | – | 22 |
| Take over subdomain undici.nodejs.org.cdn.cloudflare.netAnalysed#1763817 | Valid | Memory Corruption | Medium | 2023-01-11 | – | 22 |
| OOB read in libuv#1209681 | Valid | Memory Corruption | Medium | 2021-07-05 | – | 5 |
| `fs.realpath.native` on darwin may cause buffer overflow#965914 | Valid | Memory Corruption | Medium | 2020-10-17 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.