Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Http response is not ended although underlying socket is already destroyed#676710	Informative	Denial of Service	–	2020-01-15	–	1
Use After Free in crypto.randomFill#340053	Informative	Memory Corruption	–	2020-01-15	–	2
CRLF Injection in legacy url API (url.parse().hostname)#771596	Informative	Injection and Smuggling	–	2020-01-10	–	2
Hostname spoofing#678487	Informative	No weakness recorded	–	2020-01-10	–	3
Child process environment injection via prototype pollution#878181	Informative	Command and Code Injection	–	2020-07-04	–	3
Node --run POSIX positional argument escaping allows shell command injection#3817602	Informative	Command and Code Injection	High	2026-06-23	–	13
Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes#2260337	Informative	Access Control	–	2024-08-08	–	20
Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling#3463949	Informative	Cryptography	High	2025-12-19	–	24
Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)#3752489	Informative	Race Conditions	High	2026-05-23	–	32
Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix#3255707	Informative	File and Path Handling	High	2025-07-28	–	39
Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions#3781015	Informative	Denial of Service	High	2026-06-12	–	41
NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset#3736889	Informative	Memory Corruption	High	2026-05-23	–	44
CWE-195 in ExternalMemoryAccounter::Increase()#3302484	Informative	No weakness recorded	–	2025-08-26	–	55

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.