CVE-2021-3664: Open redirect in url-parse
Summary
CVE-2021-3664: Open redirect in url-parse. Affects url-parse versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Also tracked for
- node-url-parse · Debian:11
The same CVE-2021-3664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package 'url-parse' is a library that provides URL parsing and manipulation capabilities. It is commonly used in JavaScript applications to handle URLs. However, versions of 'url-parse' prior to 1.5.2 are vulnerable to an open redirect vulnerability, which can lead to URL redirection to untrusted sites. This vulnerability can be exploited to bypass allow/block lists, perform SSRF attacks, or cause other undesired behavior.
Vulnerability Detail
The vulnerability in 'url-parse' allows an attacker to manipulate URLs in a way that can redirect users to malicious or untrusted websites. This can be achieved by providing a specially crafted URL that triggers the open redirect behavior. The impact of this vulnerability depends on how the library is used in the application and the intent of the attacker. Possible consequences include bypassing allow/block lists, enabling SSRF attacks, or causing unexpected behavior in the application.
How To Fix
Latest published version: 1.5.10 as of 22 Oct 2026
npm install url-parse@1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
npm install url-parse@1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The 'url-parse' package is vulnerable to an open redirect vulnerability that can have various impacts depending on the application's usage. It is crucial to update the package to version 1.5.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for url-parse →
FAQ
Depending on the usage of the 'url-parse' library and the attacker's intent, the impact can include bypassing allow/block lists, enabling SSRF attacks, or causing other undesired behavior.
To fix this vulnerability, update the 'url-parse' package to version 1.5.2 or later.
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version.
Yes, this vulnerability can be exploited remotely by providing a specially crafted URL.
There is no known public exploit for this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for url-parse.
