Description
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Recommendation
Update the url-parse package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.1.0, < 1.5.0
- Patched version(s): 1.5.0
References
- GHSA-9m6j-fcg5-2442
- advisory.checkmarx.net
- lists.debian.org
- CVE-2021-27515
- CWE-23
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Open redirect in url-parse - url-parse - CVE-2021-3664
- Improper Validation and Sanitization in url-parse - CVE-2020-8124
- Authorization bypass in url-parse - CVE-2022-0512
- Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory - CVE-2026-30848
You might also like:
- Tags:
- npm
- url-parse
Anything's wrong? Let us know Last updated on February 03, 2026