Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
HTTP Request Smuggling due to CR-to-Hyphen conversionAnalysed#922597	Valid	Injection and Smuggling	High	2020-10-17	–	134
"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashAnalysed#2319584	Valid	Denial of Service	High	2024-04-08	–	65
Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSAnalysed#3556769	Valid	No weakness recorded	High	2026-04-23	–	59
Improper error handling in async cryptographic operations crashes processAnalysed#2817648	Valid	Cryptography	High	2025-05-14	–	37
TLS certificate hostname bypass when the IP is written fullwidth digitsAnalysed#4038287	Valid	Cryptography	High	2026-10-23	–	29
Node.js: TLS session reuse can lead to hostname verification bypassAnalysed#811502	Valid	Cryptography	High	2020-06-03	–	29
TLS certificate hostname bypass when the host loosely resolves to an IP addressAnalysed#4006744	Valid	Cryptography	High	2026-10-23	–	24
Code injection and privilege escalation through Linux capabilitiesAnalysed#2237545	Valid	Access Control	High	2024-02-15	–	23
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Analysed#3560402	Valid	Denial of Service	High	2026-03-30	–	22

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.