Medium

url-parse Incorrectly parses URLs that include an '@'

Disclosed: 18.02.2022
Updated: 11.10.2026 10:22

A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,

parse(\"http://@/127.0.0.1\")

Will return:

yaml

{
 slashes: true,
 protocol: 'http:',
 hash: '',
 query: '',
 pathname: '/127.0.0.1',
 auth: '',
 host: '',
 port: '',
 hostname: '',
 password: '',
 username: '',
 origin: 'null',
 href: 'http:///127.0.0.1'
 }

If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	url-parse	>= 1.0.0, < 1.5.7	1.5.7

References

CVSS score 6.5/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-639
Platform: npm
Package: url-parse
Disclosed: 18.02.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8v38-pw62-9cw2 - CC BY 4.0

Vulnerability history: url-parse

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 8
First → latest: 08.2018 02.2022
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 2
Medium 6

Disclosures per year

2018: 1
2019: 0
2020: 0
2021: 2
2022: 5
2023: 0
2024: 0
2025: 0
2026: 0

22.02.2022

url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.

Medium · 6.5 CVE-2022-0691 >= 0.1.0, < 1.5.9 1.5.9
21.02.2022

Authorization Bypass Through User-Controlled Key in url-parse

Critical · 9.1 CVE-2022-0686 < 1.5.8 1.5.8
18.02.2022

url-parse Incorrectly parses URLs that include an '@' this entry

Medium · 6.5 CVE-2022-0639 >= 1.0.0, < 1.5.7 1.5.7
15.02.2022

Authorization bypass in url-parse

Medium · 5.3 CVE-2022-0512 >= 0.1.0, < 1.5.6 1.5.6
06.01.2022

Improper Validation and Sanitization in url-parse

Medium · 5.3 CVE-2020-8124 >= 0.1.0, < 1.4.5 1.4.5
10.08.2021

Open redirect in url-parse

Medium · 6.1 CVE-2021-3664 >= 0.1.0, < 1.5.2 1.5.2
06.05.2021

Path traversal in url-parse

Medium · 5.3 CVE-2021-27515 >= 0.1.0, < 1.5.0 1.5.0
13.08.2018

Open Redirect in url-parse

Critical · 10.0 CVE-2018-3774 >= 1.0.0, < 1.4.3 1.4.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application