Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakAnalysed#3473882	Valid	Denial of Service	Medium	2026-02-12	–	81
Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSAnalysed#3556769	Valid	No weakness recorded	High	2026-04-23	–	59
HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parserAnalysed#3723248	Valid	Injection and Smuggling	Medium	2026-07-31	–	49
Memory leak that enables remote Denial of Service against applications processing TLS client certificatesAnalysed#3357723	Valid	Denial of Service	Medium	2026-02-12	–	34
Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status LineAnalysed#3648681	Valid	Injection and Smuggling	Medium	2026-07-01	–	30
TLS certificate hostname bypass when the IP is written fullwidth digitsAnalysed#4038287	Valid	Cryptography	High	2026-10-23	–	29
Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionAnalysed#3456148	Valid	No weakness recorded	–	2026-02-23	–	25
TLS certificate hostname bypass when the host loosely resolves to an IP addressAnalysed#4006744	Valid	Cryptography	High	2026-10-23	–	24
Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Analysed#3560402	Valid	Denial of Service	High	2026-03-30	–	22
HashDoS in V8Analysed#3511792	Valid	Cryptography	Medium	2026-03-30	–	19
Keep-alive socket process a response that was written before the request was sentAnalysed#4038361	Valid	Race Conditions	Medium	2026-10-23	–	15

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.