Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
154 of 15,219 reports · $2,650 in bounties · 161 analysed so far
- #922597ValidHTTP Request Smuggling due to CR-to-Hyphen conversionNode.js · Injection and Smuggling · 2020–134votes
- #2054283ValidImproper HTTP header block termination in llhttpNode.js · Injection and Smuggling · 2025 · Medium–122votes
- #735748ValidHTTP request smuggling using malformed Transfer-Encoding headerNode.js · Injection and Smuggling · 2020–105votes
- #3473882ValidTLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakNode.js · Denial of Service · 2026 · Medium–81votes
- #2319584Valid"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashNode.js · Denial of Service · 2024–65votes
- #3556769ValidIncomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSNode.js · No weakness recorded · 2026 · High–59votes
- #3083428ValidCorrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · Memory Corruption · 2025 · Low–59votes
- #2307225ValidPath traversal by drive name in Windows environmentNode.js · File and Path Handling · 2025 · Medium–59votes
- #3302484InformativeCWE-195 in ExternalMemoryAccounter::Increase()Node.js · No weakness recorded · 2025–55votes
- #3131758ValidHashDoS in V8Node.js · Cryptography · 2025 · High–53votes
- #3465156ValidNode.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Node.js · Server-Side Request Forgery · 2026 · Medium–52votes
- #3723248ValidHTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parserNode.js · Injection and Smuggling · 2026 · Medium–49votes
- #409943ValidHttp request splittingNode.js · Injection and Smuggling · 2020–45votes
- #3736889InformativeNULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetNode.js · Memory Corruption · 2026 · High–44votes
- #2084280ValidWASI sandbox escape via symlinkNode.js · Access Control · 2025 · Medium–44votes
- #3405778ValidTimeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilledNode.js · Memory Corruption · 2026 · High–43votes
- #2575105ValidWorker permission bypass via InternalWorker leak in diagnosticsNode.js · Access Control · 2025 · High–42votes
- #3781015InformativeIncomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsNode.js · Denial of Service · 2026 · High–41votes
- #3546390ValidAssertion error in node_url.cc via malformed URL format leads to Node.js crashNode.js · Denial of Service · 2026 · Medium–40votes
- #3255707InformativeWindows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixNode.js · File and Path Handling · 2025 · High–39votes
- #3812439ValidHTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Node.js · Other weaknesses · 2026 · Medium–37votes
- #2817648ValidImproper error handling in async cryptographic operations crashes processNode.js · Cryptography · 2025 · High–37votes
- #2218653ValidPath traversal by monkey-patching Buffer internalsNode.js · File and Path Handling · 2024–36votes
- #3815767ValidPermission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write pathsNode.js · Access Control · 2026 · Low–35votes
- #3456295ValidUncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlersNode.js · Input Validation and Logic · 2026 · Medium–35votes
- #3160912ValidWindows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Node.js · File and Path Handling · 2025 · High–35votes
- #2079103ValidPermission model improperly processes UNC pathsNode.js · Access Control · 2024 · Low–35votes
- #340580Validregistry.nodejs.org Subdomain TakeoverNode.js · Cryptography · 2018–35votes
- #3417819ValidFS Permissions BypassNode.js · Misconfiguration and Insecure Design · 2026 · High–34votes
- #3390084Validfs.futimes() Bypasses Read-Only Permission ModelNode.js · Access Control · 2026 · Low–34votes
- #3357723ValidMemory leak that enables remote Denial of Service against applications processing TLS client certificatesNode.js · Denial of Service · 2026 · Medium–34votes
- #1002188ValidPotential HTTP Request Smuggling in nodejsNode.js · Injection and Smuggling · 2021$25034votes
- #3761342ValidPermission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantNode.js · Access Control · 2026 · High–33votes
- #3658225ValidHTTP/2 sessions never clean up after GOAWAY on invalid protocol errorsNode.js · Denial of Service · 2026 · Medium–33votes
- #3752489InformativeMemory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)Node.js · Race Conditions · 2026 · High–32votes
- #3648681ValidImproper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status LineNode.js · Injection and Smuggling · 2026 · Medium–30votes
- #4038287ValidTLS certificate hostname bypass when the IP is written fullwidth digitsNode.js · Cryptography · 2026 · High–29votes
- #3692858ValidPermission Model Bypass via `process.report.writeReport()` Path MisvalidationNode.js · Access Control · 2026 · Low–29votes
- #811502ValidNode.js: TLS session reuse can lead to hostname verification bypassNode.js · Cryptography · 2020–29votes
- #2284065ValidDenial of Service by resource exhaustion in fetch() brotli decodingNode.js · Denial of Service · 2024–27votes
- #988103ValidNode.js: use-after-free in TLSWrapNode.js · Memory Corruption · 2021–27votes
- #3456148ValidUnbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionNode.js · No weakness recorded · 2026–25votes
- #4006744ValidTLS certificate hostname bypass when the host loosely resolves to an IP addressNode.js · Cryptography · 2026 · High–24votes
- #3816840ValidHTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificatesNode.js · Authentication · 2026 · Medium–24votes
- #3463949InformativeMissing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingNode.js · Cryptography · 2025 · High–24votes
- #2913312ValidUsage of unsafe random function in undici for choosing boundaryNode.js · Cryptography · 2025 · Medium–24votes
- #2170226Validsetuid() does not drop all privileges due to io_uringNode.js · Access Control · 2024–24votes
- #2237545ValidCode injection and privilege escalation through Linux capabilitiesNode.js · Access Control · 2024–23votes
- #3824331ValidNull Dereference in X509ToObjectNode.js · Memory Corruption · 2026 · Medium–22votes
- #3560402ValidDenial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Node.js · Denial of Service · 2026 · High–22votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.