Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper HTTP header block termination in llhttp#2054283	Valid	Injection and Smuggling	Medium	2025-06-13	–	122
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.#3083428	Valid	Memory Corruption	Low	2025-05-15	–	59
Path traversal by drive name in Windows environment#2307225	Valid	File and Path Handling	Medium	2025-01-27	–	59
CWE-195 in ExternalMemoryAccounter::Increase()#3302484	Informative	No weakness recorded	–	2025-08-26	–	55
HashDoS in V8#3131758	Valid	Cryptography	High	2025-07-15	–	53
WASI sandbox escape via symlink#2084280	Valid	Access Control	Medium	2025-05-24	–	44
Worker permission bypass via InternalWorker leak in diagnostics#2575105	Valid	Access Control	High	2025-01-21	–	42
Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix#3255707	Informative	File and Path Handling	High	2025-07-28	–	39
Improper error handling in async cryptographic operations crashes process#2817648	Valid	Cryptography	High	2025-05-14	–	37
Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()#3160912	Valid	File and Path Handling	High	2025-07-15	–	35
Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling#3463949	Informative	Cryptography	High	2025-12-19	–	24
Usage of unsafe random function in undici for choosing boundary#2913312	Valid	Cryptography	Medium	2025-01-23	–	24
GOAWAY HTTP/2 frames cause memory leak outside heap#2841362	Valid	Denial of Service	Medium	2025-02-06	–	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.