GitHub Advisoryadvisory · npm

GHSA-pv4c-p2j5-38j4 Open Redirect in url-parse

CRITICAL Published 2018-08-13 Modified 2026-01-23 Official page ↗
Aliases
CVE-2018-3774
Ecosystem
npm
Packages
url-parse
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-425
Reviewed
2020-06-16

Affected packages

• npm url-parse: >= 1.0.0, < 1.4.3 → fixed in 1.4.3

Description

Versions of `url-parse` before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities. Recommendation Update to version 1.4.3 or later.

Related

Alias · CVE (1)

  • CVE-2018-3774 Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass… vulnerability

Weakness · CWE (1)

References