Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset#3736889 | Informative | Memory Corruption | High | 2026-05-23 | – | 44 |
| Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions#3781015 | Informative | Denial of Service | High | 2026-06-12 | – | 41 |
| Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix#3255707 | Informative | File and Path Handling | High | 2025-07-28 | – | 39 |
| Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)#3752489 | Informative | Race Conditions | High | 2026-05-23 | – | 32 |
| Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling#3463949 | Informative | Cryptography | High | 2025-12-19 | – | 24 |
| Node --run POSIX positional argument escaping allows shell command injection#3817602 | Informative | Command and Code Injection | High | 2026-06-23 | – | 13 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.