Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Regular Expression Denial of Service in Headers#1784449	Valid	Denial of Service	–	2023-03-19	–	3
Insecure loading of ICU data through ICU_DATA environment variable#1625036	Valid	No weakness recorded	–	2023-03-19	–	4
OpenSSL engines can be used to bypass and/or disable the permission model#1954535	Valid	Access Control	–	2023-06-22	–	4
Multiple OpenSSL error handling issues in nodejs crypto library#1808596	Valid	Cryptography	–	2023-02-17	–	5
Filesystem experimental permissions policy does not handle path traversal cases.#1952978	Valid	File and Path Handling	–	2023-07-20	–	5
fs module's file watching is not restricted by --allow-fs-read#1966499	Valid	Access Control	–	2023-07-20	–	5
Process-based permissions can be bypassed with the "inspector" module.#1962701	Valid	Access Control	–	2023-07-20	–	6
fs.openAsBlob() bypasses permission system#1966492	Valid	Access Control	–	2023-07-20	–	6
Permissions policies can be bypassed via process.mainModule#1747642	Valid	Access Control	–	2023-03-19	–	7
DiffieHellman doesn't generate keys after setting a key#1927480	Valid	Other weaknesses	–	2023-07-20	–	7
The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1#1877919	Valid	Access Control	–	2023-07-20	–	8
HTTP Request Smuggling via Empty headers separated by CR#2001873	Valid	Injection and Smuggling	–	2023-06-20	–	8
CRLF Injection in Nodejs ‘undici’ via host#1820955	Valid	Injection and Smuggling	–	2023-02-22	–	11
Take over subdomain undici.nodejs.org.cdn.cloudflare.net#1763817	Valid	Memory Corruption	–	2023-01-11	–	22

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.