Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
14 of 15,219 reports · 227 analysed so far
- #1632921ValidDNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Node.js · Access Control · 2022–16votes
- #1431042ValidPrototype pollution via console.table propertiesNode.js · Other weaknesses · 2022–16votes
- #1631350ValidOff-by-slash vulnerability in nodejs.org and iojs.orgNode.js · File and Path Handling · 2022–12votes
- #1690000ValidWeak randomness in WebCrypto keygenNode.js · Cryptography · 2022–11votes
- #1524692ValidHTTP Request Smuggling Due To Improper Delimiting of Header FieldsNode.js · Injection and Smuggling · 2022–9votes
- #1524555ValidHTTP Request Smuggling Due to Flawed Parsing of Transfer-EncodingNode.js · Injection and Smuggling · 2022–7votes
- #1501679ValidHTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-EncodingNode.js · Injection and Smuggling · 2022–7votes
- #1675191ValidHTTP Request Smuggling Due to Incorrect Parsing of Header FieldsNode.js · Injection and Smuggling · 2022–6votes
- #1665156ValidHTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)Node.js · Injection and Smuggling · 2022–6votes
- #1630336ValidCVE-2022-32213 bypass via obs-fold mechanicNode.js · Injection and Smuggling · 2022–5votes
- #1710652ValidDNS rebinding in --inspect via invalid octal IP addressNode.js · Command and Code Injection · 2022–4votes
- #1583680ValidUndici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxyNode.js · Cryptography · 2022–4votes
- #1695596ValidNode 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOSNode.js · Cryptography · 2022–3votes
- #1429694ValidNode.js Certificate Verification Bypass via String InjectionNode.js · Cryptography · 2022–2votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.