Url-parse ProjectCVEs & Vulnerabilities
8 CVEs affecting Url-parse Project products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.
Most Affected Products
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
url-parse is vulnerable to URL Redirection to Untrusted Site
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.