Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper HTTP header block termination in llhttpAnalysed#2054283	Valid	Injection and Smuggling	Medium	2025-06-13	–	122
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.#3083428	Valid	Memory Corruption	Low	2025-05-15	–	59
Path traversal by drive name in Windows environmentAnalysed#2307225	Valid	File and Path Handling	Medium	2025-01-27	–	59
HashDoS in V8Analysed#3131758	Valid	Cryptography	High	2025-07-15	–	53
WASI sandbox escape via symlinkAnalysed#2084280	Valid	Access Control	Medium	2025-05-24	–	44
Worker permission bypass via InternalWorker leak in diagnosticsAnalysed#2575105	Valid	Access Control	High	2025-01-21	–	42
Improper error handling in async cryptographic operations crashes processAnalysed#2817648	Valid	Cryptography	High	2025-05-14	–	37
Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()#3160912	Valid	File and Path Handling	High	2025-07-15	–	35
Usage of unsafe random function in undici for choosing boundary#2913312	Valid	Cryptography	Medium	2025-01-23	–	24
GOAWAY HTTP/2 frames cause memory leak outside heap#2841362	Valid	Denial of Service	Medium	2025-02-06	–	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.