The unofficial HackerOne disclosure Timeline

b'Node.js' disclosed a bug submitted by b'tmeletlidis'
b'Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'tmeletlidis'
b'Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'3d7omb'
b'TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'muhammaddaffa'
b'Permission Model bypass via FileHandle.utimes() in the promises API'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'nssys'
b'Proxy credentials leaked in ERR_PROXY_TUNNEL error message'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'kingsd'
b'Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'tmeletlidis'
b'Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings'

25 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'erichen'
b'Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)'

25 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'zhenyan'
b"HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session"

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bagder'
b'CVE-2026-11564: Native CA trust persist'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'alienowo'
b'CVE-2026-12064: proto-default skips SSH verification'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'evergarden1123'
b'CVE-2026-11586: WS Auto-PONG memory exhaustion'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'vectorqueue'
b'CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-10536: HTTP/2 stream-dependency tree UAF'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'vegagent'
b'CVE-2026-8924: trailing dot domain super cookie'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-9547: SSH improper host validation'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'fafawf'
b'CVE-2026-9546: sending old referer'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'keen4n'
b'CVE-2026-9079: stale proxy password leak'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-9080: UAF after pause in socket callback'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bagder'
b'CVE-2026-8286: wrong STARTTLS connection reuse'

24 Jun 2026 timeline

1 ... 7 8 9 10 11 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.