Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Potential HTTP Request Smuggling in nodejs#1002188	Valid	Injection and Smuggling	–	2021-01-07	$250	34
Node.js: use-after-free in TLSWrap#988103	Valid	Memory Corruption	–	2021-01-05	–	27
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254	Valid	Cryptography	–	2021-09-10	$150	20
HTTP Request Smuggling due to accepting space before colon#1238709	Valid	Injection and Smuggling	–	2021-10-20	$250	18
Node Installer Local Privilege Escalation#1211160	Valid	Access Control	–	2021-07-01	–	10
HTTP Request Smuggling due to ignoring chunk extensions#1238099	Valid	Injection and Smuggling	–	2021-11-02	$250	7
OOB read in libuv#1209681	Valid	Memory Corruption	–	2021-07-05	–	5
DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)#1069487	Valid	Access Control	–	2021-02-23	$500	5
Improper handling of untypical characters in domain names#1178337	Valid	Memory Corruption	–	2021-09-10	–	4
Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals.#1141623	N/A	Memory Corruption	–	2021-06-14	–	4
HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion#1043360	Valid	Denial of Service	–	2021-03-15	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.