CVE-2022-0639: Vulnerability in url-parse package
Summary
CVE-2022-0639: url-parse Incorrectly parses URLs that include an '@'. Affects url-parse versions < 1.5.7. Fixed in 1.5.7. How to fix ↓
Also tracked for
- node-url-parse · Debian:11
The same CVE-2022-0639 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The url-parse package is an npm package used for parsing and manipulating URLs. It provides a convenient way to extract various components of a URL and perform operations on them. However, a vulnerability has been discovered in the package that can lead to incorrect parsing of URLs containing an '@' sign but empty user info and no hostname.
Vulnerability Detail
The vulnerability occurs when a specially crafted URL with an '@' sign but empty user info and no hostname is parsed using url-parse. In such cases, url-parse returns an incorrect href value. This can have security implications if the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute is then used to make a request. Attackers could potentially exploit this vulnerability to bypass security measures or perform unauthorized actions.
How To Fix
Latest published version: 1.5.10 as of 22 Oct 2026
npm install url-parse@1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.7
This is the first release that contains the fix.
npm install url-parse@1.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the url-parse package is not immediately feasible, developers can implement a workaround by manually checking and validating the parsed URL components before using them in security decisions or making requests. This can help mitigate the risk of incorrect decisions based on the incorrect href value. Here's an example of how to manually validate the parsed URL components in JavaScript:
const parsedUrl = parse('http://@/127.0.0.1');
if (parsedUrl.hostname || parsedUrl.origin) {
// Valid URL, proceed with security decisions
} else {
// Invalid URL, handle accordingly
}
Conclusion
The url-parse package is vulnerable to a parsing issue that can lead to incorrect href values. It is recommended to update to version 1.5.7 or later to fix this vulnerability. If immediate update is not possible, developers can implement a workaround by manually validating the parsed URL components. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for url-parse →
FAQ
The vulnerability can lead to incorrect parsing of URLs, which may result in incorrect security decisions. This can potentially be exploited by attackers to bypass security measures or perform unauthorized actions.
The vulnerability affects versions 0.0.1 through 1.5.6 of the url-parse package.
Yes, the vulnerability has been fixed in version 1.5.7 of the url-parse package. It is recommended to update to this version or later.
Yes, you can manually check and validate the parsed URL components before using them in security decisions or making requests. This can help mitigate the risk of incorrect decisions based on the incorrect href value.
For more information about the vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-8v38-pw62-9cw2/GHSA-8v38-pw62-9cw2.json
Related vulnerabilities
Recent vulnerabilities recorded for url-parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
