{"action":"Upgrade url-parse to 1.5.9 or later.","affected":[{"fixed":"1.5.9","introduced":"0.1.0"}],"component":"url-parse","cve_ids":["CVE-2022-0691"],"ecosystem":"npm","epss":0.0222,"exploited":false,"fixed_versions":["1.5.9"],"ghsa_id":"GHSA-jf5r-8hm2-f872","id":"tcs_01M5KFXS53MWE2RZX7G5J3E6SK","modified_at":"2026-02-03T22:19:28.188485Z","published_at":"2022-02-22T00:00:30Z","references":["https://osv.dev/vulnerability/GHSA-jf5r-8hm2-f872","https://nvd.nist.gov/vuln/detail/CVE-2022-0691","https://github.com/github/advisory-database/pull/6765","https://github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63","https://github.com/unshiftio/url-parse","https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4","https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html","https://security.netapp.com/advisory/ntap-20220325-0006"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jf5r-8hm2-f872","url":"https://osv.dev/vulnerability/GHSA-jf5r-8hm2-f872"}],"summary":"url-parse incorrectly parses hostname / protocol due to unstripped leading control characters."}