Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
23 of 15,219 reports · 161 analysed so far
- #3556769ValidIncomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSNode.js · No weakness recorded · 2026 · High–59votes
- #3131758ValidHashDoS in V8Node.js · Cryptography · 2025 · High–53votes
- #3736889InformativeNULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetNode.js · Memory Corruption · 2026 · High–44votes
- #3405778ValidTimeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilledNode.js · Memory Corruption · 2026 · High–43votes
- #2575105ValidWorker permission bypass via InternalWorker leak in diagnosticsNode.js · Access Control · 2025 · High–42votes
- #3781015InformativeIncomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsNode.js · Denial of Service · 2026 · High–41votes
- #3255707InformativeWindows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixNode.js · File and Path Handling · 2025 · High–39votes
- #2817648ValidImproper error handling in async cryptographic operations crashes processNode.js · Cryptography · 2025 · High–37votes
- #3160912ValidWindows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Node.js · File and Path Handling · 2025 · High–35votes
- #3417819ValidFS Permissions BypassNode.js · Misconfiguration and Insecure Design · 2026 · High–34votes
- #3761342ValidPermission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantNode.js · Access Control · 2026 · High–33votes
- #3752489InformativeMemory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)Node.js · Race Conditions · 2026 · High–32votes
- #4038287ValidTLS certificate hostname bypass when the IP is written fullwidth digitsNode.js · Cryptography · 2026 · High–29votes
- #4006744ValidTLS certificate hostname bypass when the host loosely resolves to an IP addressNode.js · Cryptography · 2026 · High–24votes
- #3463949InformativeMissing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingNode.js · Cryptography · 2025 · High–24votes
- #3560402ValidDenial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Node.js · Denial of Service · 2026 · High–22votes
- #2461831ValidBypass incomplete fix of CVE-2024-27980Node.js · Command and Code Injection · 2024 · High–20votes
- #4038342Validdns.resolve truncates names containing NUL charNode.js · Access Control · 2026 · High–18votes
- #3688064ValidNode.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatNode.js · Injection and Smuggling · 2026 · High–18votes
- #3833629ValidRe-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2Node.js · Memory Corruption · 2026 · High–17votes
- #3817602InformativeNode --run POSIX positional argument escaping allows shell command injectionNode.js · Command and Code Injection · 2026 · High–13votes
- #3760016ValidNode.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)Node.js · Memory Corruption · 2026 · High–13votes
- #3846922ValidHTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustionNode.js · Denial of Service · 2026 · High–12votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.