Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Analysed#3465156	Valid	Server-Side Request Forgery	Medium	2026-02-12	–	52
HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Analysed#3812439	Valid	Other weaknesses	Medium	2026-07-30	–	37
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write pathsAnalysed#3815767	Valid	Access Control	Low	2026-07-30	–	35
FS Permissions BypassAnalysed#3417819	Valid	Misconfiguration and Insecure Design	High	2026-02-12	–	34
fs.futimes() Bypasses Read-Only Permission ModelAnalysed#3390084	Valid	Access Control	Low	2026-01-15	–	34
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantAnalysed#3761342	Valid	Access Control	High	2026-07-29	–	33
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificatesAnalysed#3816840	Valid	Authentication	Medium	2026-07-29	–	24
Null Dereference in X509ToObjectAnalysed#3824331	Valid	Memory Corruption	Medium	2026-10-23	–	22
Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`Analysed#3838601	Valid	Access Control	Low	2026-07-29	–	21
dns.resolve truncates names containing NUL charAnalysed#4038342	Valid	Access Control	High	2026-10-23	–	18
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP ParserAnalysed#3564941	Valid	Injection and Smuggling	Low	2026-08-28	–	16
Permission Model bypass with fs.realpathSyncAnalysed#3838675	Valid	Access Control	Low	2026-10-23	–	15
Permission Model Bypass in realpathSync.native Allows File Existence DisclosureAnalysed#3480841	Valid	Information Disclosure	Low	2026-03-30	–	15

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.