HackerOne Disclosed Reports - 2026-11-12

High
resolved

HTTP/2 stream teardown can send freed response memory to the peer

Bug reported by Aidan Vasconi · Arquebus was disclosed at November 12, 2026, 3:46 pm   |   Use After Free

A flaw in HTTP/2 stream teardown was identified that could result in freed response memory being sent to peers. This vulnerability affected multiple versions of the Node.js runtime.

Medium
resolved

HTTPS Agent reuses TLS authentication state across distinct secureContext policies

Bug reported by Mickey Joe was disclosed at November 12, 2026, 2:13 pm   |   Improper Certificate Validation

A flaw in TLS hostname handling was identified that allowed HTTPS Agent to reuse TLS authentication state across distinct secureContext policies. The vulnerability affected multiple versions of a JavaScript runtime environment.

Low
resolved

Public board pages are served Cache-Control: public with no Vary: Cookie, so a signed-in visitor's response is cached at the edge and returned to ev

Bug reported by YoussefAbida was disclosed at November 12, 2026, 10:53 am   |   Information Disclosure

Public board pages were served with Cache-Control: public headers without a Vary: Cookie directive. When a signed-in user accessed a public board link, the response containing their session data, including CSP nonce, CSRF token, user ID, and timezone, was cached at the edge. Subsequently, unauthenticated requests to the same URL were served this cached response for up to 30 seconds, exposing the original user's session information to other visitors. The issue was caused by the public controller marking responses as publicly cacheable while session data was still being populated in the response body. The vulnerability was resolved by preventing public caching when a session was active.