Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Node.js Certificate Verification Bypass via String Injection#1429694	Valid	Cryptography	–	2022-02-10	–	2
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS#1695596	Valid	Cryptography	–	2022-10-26	–	3
Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy#1583680	Valid	Cryptography	–	2022-07-13	–	4
DNS rebinding in --inspect via invalid octal IP address#1710652	Valid	Command and Code Injection	–	2022-12-07	–	4
CVE-2022-32213 bypass via obs-fold mechanic#1630336	Valid	Injection and Smuggling	–	2022-10-26	–	5
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)#1665156	Valid	Injection and Smuggling	–	2022-10-26	–	6
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields#1675191	Valid	Injection and Smuggling	–	2022-10-26	–	6
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding#1501679	Valid	Injection and Smuggling	–	2022-07-07	–	7
HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding#1524555	Valid	Injection and Smuggling	–	2022-07-07	–	7
HTTP Request Smuggling Due To Improper Delimiting of Header Fields#1524692	Valid	Injection and Smuggling	–	2022-07-07	–	9
Weak randomness in WebCrypto keygen#1690000	Valid	Cryptography	–	2022-10-26	–	11
Off-by-slash vulnerability in nodejs.org and iojs.org#1631350	Valid	File and Path Handling	–	2022-08-24	–	12
Prototype pollution via console.table properties#1431042	Valid	Other weaknesses	–	2022-01-11	–	16
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)#1632921	Valid	Access Control	–	2022-09-28	–	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.