Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Permission Model bypass via FileHandle.utimes() in the promises API#3625987	Valid	Access Control	Low	2026-06-25	–	4
Permission Model filesystem over-grant via wildcard radix lookup#3996423	Valid	Access Control	Low	2026-10-27	–	6
CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown#3449392	Valid	Access Control	Low	2026-03-30	–	7
Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)#3618831	Valid	Access Control	Low	2026-06-25	–	8
HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`#3582376	Valid	Race Conditions	Low	2026-06-25	–	11
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure#3480841	Valid	Information Disclosure	Low	2026-03-30	–	15
Permission Model bypass with fs.realpathSync#3838675	Valid	Access Control	Low	2026-10-23	–	15
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser#3564941	Valid	Injection and Smuggling	Low	2026-08-28	–	16
fs.lstat bypasses permission model#2145862	Valid	Access Control	Low	2024-07-09	–	18
fs.fchown/fchmod bypasses permission model#2472071	Valid	Access Control	Low	2024-07-09	–	20
Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`#3838601	Valid	Access Control	Low	2026-07-29	–	21
Permission Model Bypass via `process.report.writeReport()` Path Misvalidation#3692858	Valid	Access Control	Low	2026-06-18	–	29
fs.futimes() Bypasses Read-Only Permission Model#3390084	Valid	Access Control	Low	2026-01-15	–	34
Permission model improperly processes UNC paths#2079103	Valid	Access Control	Low	2024-07-15	–	35
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths#3815767	Valid	Access Control	Low	2026-07-30	–	35
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.#3083428	Valid	Memory Corruption	Low	2025-05-15	–	59

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.