Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilledAnalysed#3405778 | Valid | Memory Corruption | High | 2026-02-12 | – | 43 |
| Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Analysed#3160912 | Valid | File and Path Handling | High | 2025-07-15 | – | 35 |
| Bypass incomplete fix of CVE-2024-27980Analysed#2461831 | Valid | Command and Code Injection | High | 2024-07-09 | – | 20 |
| Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatAnalysed#3688064 | Valid | Injection and Smuggling | High | 2026-06-25 | – | 18 |
| Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2Analysed#3833629 | Valid | Memory Corruption | High | 2026-08-28 | – | 17 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.