Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
16 of 15,219 reports · 227 analysed so far
- #3083428ValidCorrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · Memory Corruption · 2025 · Low–59votes
- #3815767ValidPermission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write pathsNode.js · Access Control · 2026 · Low–35votes
- #2079103ValidPermission model improperly processes UNC pathsNode.js · Access Control · 2024 · Low–35votes
- #3390084Validfs.futimes() Bypasses Read-Only Permission ModelNode.js · Access Control · 2026 · Low–34votes
- #3692858ValidPermission Model Bypass via `process.report.writeReport()` Path MisvalidationNode.js · Access Control · 2026 · Low–29votes
- #3838601ValidPermission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`Node.js · Access Control · 2026 · Low–21votes
- #2472071Validfs.fchown/fchmod bypasses permission modelNode.js · Access Control · 2024 · Low–20votes
- #2145862Validfs.lstat bypasses permission modelNode.js · Access Control · 2024 · Low–18votes
- #3564941ValidHTTP Request Smuggling via Silent Header Truncation in Node.js HTTP ParserNode.js · Injection and Smuggling · 2026 · Low–16votes
- #3838675ValidPermission Model bypass with fs.realpathSyncNode.js · Access Control · 2026 · Low–15votes
- #3480841ValidPermission Model Bypass in realpathSync.native Allows File Existence DisclosureNode.js · Information Disclosure · 2026 · Low–15votes
- #3582376ValidHTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`Node.js · Race Conditions · 2026 · Low–11votes
- #3618831ValidUnix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)Node.js · Access Control · 2026 · Low–8votes
- #3449392ValidCVE-2024-36137 Patch Bypass - FileHandle.chmod/chownNode.js · Access Control · 2026 · Low–7votes
- #3996423ValidPermission Model filesystem over-grant via wildcard radix lookupNode.js · Access Control · 2026 · Low–6votes
- #3625987ValidPermission Model bypass via FileHandle.utimes() in the promises APINode.js · Access Control · 2026 · Low–4votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.