Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Potential HTTP Request Smuggling in nodejs#1002188	Valid	Injection and Smuggling	–	2021-01-07	$250	34
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254	Valid	Cryptography	–	2021-09-10	$150	20
HTTP Request Smuggling due to accepting space before colon#1238709	Valid	Injection and Smuggling	–	2021-10-20	$250	18
Malformed HTTP/2 SETTINGS frame leads to reachable assert#800140	Valid	Denial of Service	–	2020-07-03	$250	14
Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests#868834	Valid	Denial of Service	–	2020-10-17	$250	8
Slowloris, body parsing#799072	Valid	Denial of Service	–	2020-10-17	$250	8
HTTP Request Smuggling due to ignoring chunk extensions#1238099	Valid	Injection and Smuggling	–	2021-11-02	$250	7
napi_get_value_string_X allow various kinds of memory corruption#784186	Valid	Memory Corruption	–	2020-07-02	$250	7
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)#1069487	Valid	Access Control	–	2021-02-23	$500	5
DNS Max Responses for DOS#1033107	Valid	Denial of Service	–	2020-12-16	$250	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.