HackerOne Disclosed Reports - 2026-07-31

Medium
resolved

HTTP Request Smuggling via Connection: close in Node.js llhttp parser

Bug reported by Nadav Magier was disclosed at July 31, 2026, 3:27 pm   |   HTTP Request Smuggling

A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.

Low
resolved

Stored XSS in nameserver field on account settings page

Bug reported by Axolot was disclosed at July 31, 2026, 3:07 pm   |   Cross-site Scripting (XSS) - Stored

A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.