Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)#1632921	Valid	Access Control	High	2022-09-28	–	16
Prototype pollution via console.table properties#1431042	Valid	Other weaknesses	Low	2022-01-11	–	16
Off-by-slash vulnerability in nodejs.org and iojs.org#1631350	Valid	File and Path Handling	Medium	2022-08-24	–	12
Weak randomness in WebCrypto keygen#1690000	Valid	Cryptography	High	2022-10-26	–	11
HTTP Request Smuggling Due To Improper Delimiting of Header Fields#1524692	Valid	Injection and Smuggling	Medium	2022-07-07	–	9
HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding#1524555	Valid	Injection and Smuggling	Medium	2022-07-07	–	7
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding#1501679	Valid	Injection and Smuggling	Medium	2022-07-07	–	7
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields#1675191	Valid	Injection and Smuggling	Medium	2022-10-26	–	6
HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)#1665156	Valid	Injection and Smuggling	Medium	2022-10-26	–	6
CVE-2022-32213 bypass via obs-fold mechanic#1630336	Valid	Injection and Smuggling	Medium	2022-10-26	–	5
DNS rebinding in --inspect via invalid octal IP address#1710652	Valid	Command and Code Injection	Medium	2022-12-07	–	4
Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy#1583680	Valid	Cryptography	High	2022-07-13	–	4
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS#1695596	Valid	Cryptography	Medium	2022-10-26	–	3
Node.js Certificate Verification Bypass via String Injection#1429694	Valid	Cryptography	Medium	2022-02-10	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.