Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Potential HTTP Request Smuggling in nodejsAnalysed#1002188	Valid	Injection and Smuggling	Low	2021-01-07	$250	34
Node.js: use-after-free in TLSWrap#988103	Valid	Memory Corruption	High	2021-01-05	–	27
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254	Valid	Cryptography	Low	2021-09-10	$150	20
HTTP Request Smuggling due to accepting space before colon#1238709	Valid	Injection and Smuggling	Medium	2021-10-20	$250	18
Node Installer Local Privilege Escalation#1211160	Valid	Access Control	Medium	2021-07-01	–	10
HTTP Request Smuggling due to ignoring chunk extensions#1238099	Valid	Injection and Smuggling	Medium	2021-11-02	$250	7
OOB read in libuv#1209681	Valid	Memory Corruption	Medium	2021-07-05	–	5
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)#1069487	Valid	Access Control	High	2021-02-23	$500	5
Improper handling of untypical characters in domain names#1178337	Valid	Memory Corruption	High	2021-09-10	–	4
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion#1043360	Valid	Denial of Service	Critical	2021-03-15	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.