CVE-2022-0691: url-parse Incorrectly Parses Hostname/Protocol
Summary
CVE-2022-0691: url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. Affects url-parse versions < 1.5.9. Fixed in 1.5.9. How to fix ↓
Also tracked for
- node-url-parse · Debian:11
The same CVE-2022-0691 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The url-parse package is an npm package that provides a URL parsing utility for Node.js applications. It allows developers to parse URLs and extract various components such as the protocol, hostname, path, and query parameters. This package is commonly used in web applications to handle and manipulate URLs. However, a vulnerability has been discovered in the package that can lead to incorrect parsing of the hostname and protocol, potentially resulting in security issues.
Vulnerability Detail
The vulnerability in url-parse arises from the incorrect handling of leading control characters in a URL. When passed into url-parse, these control characters are not stripped, causing the URL to be mistakenly interpreted as a relative URL without a hostname and protocol. This behavior differs from the WHATWG URL parser, which trims control characters and treats the URL as an absolute URL. As a result, if url-parse is used in security decisions involving the hostname or protocol, the decision may be incorrect. Additionally, this vulnerability can potentially lead to a cross-site scripting (XSS) attack if url-parse is used to check for the javascript: protocol in URLs.
How To Fix
Latest published version: 1.5.10 as of 22 Oct 2026
npm install url-parse@1.5.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.9
This is the first release that contains the fix.
npm install url-parse@1.5.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the url-parse package is not immediately feasible, developers can implement a workaround by manually stripping leading control characters from the URL before passing it to url-parse. Here is an example of how this can be done in JavaScript:
const parse = require('url-parse');
function stripControlCharacters(url) {
return url.replace(/^[\x00-\x1F\x7F]+/, '');
}
const url = stripControlCharacters('https://example.com');
const parsedUrl = parse(url);
console.log(parsedUrl);
Conclusion
The url-parse package has a vulnerability that allows leading control characters in a URL to be incorrectly parsed, potentially leading to security issues and cross-site scripting (XSS) vulnerabilities. Developers should update the package to version 1.5.9 or higher to fix this vulnerability. If immediate updating is not possible, a workaround can be implemented to manually strip control characters from the URL. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for url-parse →
FAQ
The impact of this vulnerability depends on how the url-parse package is used in the application. If the package is used in security decisions involving the hostname or protocol, the incorrect parsing can lead to incorrect decisions and potential security vulnerabilities. Additionally, if the package is used to check for the javascript: protocol in URLs, it can result in a cross-site scripting (XSS) vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update the url-parse package to the latest version to mitigate the risk.
If you discover this vulnerability in your application, it is recommended to update the url-parse package to version 1.5.9 or higher as soon as possible. This will ensure that the incorrect parsing of leading control characters is fixed and mitigate the associated security risks.
Related vulnerabilities
Recent vulnerabilities recorded for url-parse.
