Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`#3582376 | Valid | Race Conditions | Low | 2026-06-25 | – | 11 |
| node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely#3795900 | Valid | Race Conditions | Medium | 2026-08-28 | – | 11 |
| Keep-alive socket process a response that was written before the request was sent#4038361 | Valid | Race Conditions | Medium | 2026-10-23 | – | 15 |
| Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)#3752489 | Informative | Race Conditions | High | 2026-05-23 | – | 32 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.