Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Proxy-Authorization header not cleared on cross-origin redirect in undici.request#2408074	Valid	Authentication	Low	2024-05-03	–	9
fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect#2377760	Valid	Misconfiguration and Insecure Design	–	2024-05-03	–	11
http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks#2233486	Valid	Denial of Service	High	2024-02-15	–	13
Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)#2269177	Valid	Cryptography	Medium	2024-02-15	–	16
Bypass network import restriction via data URL#2092749	Valid	Access Control	Medium	2024-07-08	–	18
fs.lstat bypasses permission model#2145862	Valid	Access Control	Low	2024-07-09	–	18
HTTP Request Smuggling via Content Length Obfuscation#2237099	Valid	Injection and Smuggling	Medium	2024-05-03	–	18
Proxy-Authorization header is not cleared in cross-domain redirect in undici#2352957	Valid	Information Disclosure	Low	2024-03-12	–	18
Improper handling of wildcards in --allow-fs-read and --allow-fs-write#2257156	Valid	Access Control	Medium	2024-02-15	–	20
Multiple permission model bypasses due to improper path traversal sequence sanitization#2259914	Valid	File and Path Handling	High	2024-02-15	–	20
Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes#2260337	Informative	Access Control	–	2024-08-08	–	20
Bypass incomplete fix of CVE-2024-27980#2461831	Valid	Command and Code Injection	High	2024-07-09	–	20
fs.fchown/fchmod bypasses permission model#2472071	Valid	Access Control	Low	2024-07-09	–	20
Code injection and privilege escalation through Linux capabilities#2237545	Valid	Access Control	High	2024-02-15	–	23
setuid() does not drop all privileges due to io_uring#2170226	Valid	Access Control	High	2024-03-16	–	24
Denial of Service by resource exhaustion in fetch() brotli decoding#2284065	Valid	Denial of Service	Medium	2024-03-16	–	27
Permission model improperly processes UNC paths#2079103	Valid	Access Control	Low	2024-07-15	–	35
Path traversal by monkey-patching Buffer internals#2218653	Valid	File and Path Handling	High	2024-02-15	–	36
"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash#2319584	Valid	Denial of Service	High	2024-04-08	–	65

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,199 analysed so far), which can be wrong. Data as of 2026-11-14.