npm/url-parse CVE-2022-0639: medium 6.5, EPSS 1.54%
url-parse Incorrectly parses URLs that include an '@'
Action: Upgrade url-parse to 1.5.7 or later.
npm i url-parse@1.5.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.5.7 | - |
Fixed versions
| 1.5.7 |
Sources
- osv: GHSA-8v38-pw62-9cw2
- https://nvd.nist.gov/vuln/detail/CVE-2022-0639
- https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788
- https://github.com/unshiftio/url-parse
- https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155
- https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/12/msg00024.html
CVE-2022-0639 · published · modified · JSON