Node.js

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays on the Tier 2 row, which Node.js reaches through its OSS-Fuzz integration, for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. The Tier 2 column runs from $100 for a one-liner to $5,000 for a complicated, high-impact change, and the memory-safety multiplier is Tier 1 only, so it does not apply here. The patch must be at least one month and under twelve months old, it is rate-limited to three submissions a person a month, the maintainers hold a veto, and sanctions and territory exclusions apply. CVE history 28 Last 12 months 183 Lifetime Memory safety 28 % Parsing/validation 24 % Access control 24 % Info disclosure 19 % Latest advisories Loading the feed Overview Node.js is the JavaScript runtime under most of the server-side web. It terminates HTTP for a very large share of application backends, it is the execution environment for essentially every JavaScript build tool and CI step, and it is the base of a huge fraction of production container images. A defect in its HTTP parsing, its permission model or its native bindings is reachable from ordinary web traffic. The metadata here lies: the HackerOne nodejs program is still open and still reports a $500 base, while the project's own SECURITY.md says "The Node.js project no longer has a bug bounty program" and routes payment to the paused Internet Bug Bounty. A report earns nothing upstream, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The project's SECURITY.md takes reports against Node.js core on any release line still in support. The whole runtime sits inside that: the JavaScript APIs, the native layer, and the bundled dependencies as Node itself uses them The whole HTTP surface: HTTP/1.1 and HTTP/2 request handling, header, chunked-encoding and trailer parsing, and any divergence from a front-end proxy that enables request smuggling or desync The permission model in full, including its policy flags and every boundary it claims to enforce over files, network destinations and child processes The entire C and C++ layer: the native bindings, the stream and buffer implementations, and anything that turns a JavaScript-supplied length or offset into an out-of-bounds access The module system end to end, covering CommonJS and ESM resolution, loaders and hooks, integrity enforcement, and anything that loads code the caller did not intend The crypto and TLS bindings as Node drives them, including certificate and hostname verification and the defaults exposed to callers Path, filename and URL handling across the fs and url APIs, especially the Windows-specific normalisation differences that let a check and a use disagree The process and isolation boundaries: child_process, worker_threads and vm, where argument or environment handling crosses from untrusted input into process creation The bundled dependencies as Node exposes them, wherever Node's own use of them is what creates the impact Out of scope Vulnerabilities in third-party npm packages rather than in Node.js core, which are an ecosystem problem with their own separate and currently paused programme The npm CLI, which is a separately owned and separately paid asset even though it ships inside every Node install Defects that actually live in V8, which is Chromium's codebase and has its own pathway, or in libuv, unless you can show Node's own use of them is what creates the impact Application-side misuse: passing user input to eval, child_process or a path API without validation and reporting the consequence One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month Most-valued findings Memory corruption in the native layer reachable from ordinary JavaScript or from network input, which is the top bug class here at 28% and the class the Patch Rewards ceiling exists for HTTP request smuggling or desync against Node's own parser, since it sits behind a proxy in most real deployments and a divergence there is exploitable across every application on the host A permission-model escape, which breaks the one boundary Node offers to people running untrusted or semi-trusted code Certificate or hostname verification failure in the TLS bindings, which silently downgrades every outbound connection an application makes A module-resolution or loader flaw that gets unintended code executed at require or import time, the shape that turns a dependency confusion into runtime compromise Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the project's own security process as described in SECURITY.md, with a detailed reproduction; an unreproducible report is not eligible Do not expect the HackerOne program's advertised bounty to pay. The project has withdrawn it, and the money it points at is the paused Internet Bug Bounty Show the bug on a current release line that is still in support, and say which one Give the release team room to ship the fix in a coordinated security release before any public writeup The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month, and at Tier 2 there is no memory-safety multiplier Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated through the Node.js security team, which batches accepted findings into a scheduled security release across the supported lines and publishes a blog advisory crediting the reporter. Hold the detail until that release has shipped. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability