Description
A specially crafted URL with an ‘@’ sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href.
Recommendation
Update the url-parse package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 1.5.7
- Patched version(s): 1.5.7
References
Could your website be exposed too?
SmartScanner can check your website for url-parse Incorrectly parses URLs that include an '@ and gives you actionable findings to investigate.
Start a free scanRelated Issues
- url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. - CVE-2022-0691
- parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing - CVE-2022-3224
- Authorization bypass in url-parse - CVE-2022-0512
- Authorization Bypass Through User-Controlled Key in url-parse - CVE-2022-0686
You might also like:
See something that needs correcting? Let us knowUpdated February 20, 2026