Open Redirect in url-parse

CRÍTICO 10.0CVE-2018-3774 · GHSA-pv4c-p2j5-38j4 · Published 12/08/2018 · updated 17/06/2026

Em resumo

CVE-2018-3774 é uma vulnerabilidade CRÍTICO (CVSS 10.0) que afeta url-parse.
Chance de exploração nos próximos 30 dias (EPSS): 3.8%, maior que 90.0% das vulnerabilidades.
Correção: atualize para 1.4.3 ou posterior.

Package	Affected versions	Patched versions
url-parse npm	`≥ 1.0.0, < 1.4.3`	`1.4.3`

Description

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

NVD description

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

References

nvd.nist.gov/vuln/detail/CVE-2018-3774 · ADVISORY
unshiftio/url-parse commit 209c296 · WEB
unshiftio/url-parse commit 53b1794 · WEB
unshiftio/url-parse commit d7b582e · WEB
hackerone.com/reports/384029 · WEB
unshiftio/url-parse · PACKAGE
unshiftio/url-parse · WEB

Mais vulnerabilidades de url-parse

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

url-parse

npm

≥ 1.0.0, < 1.4.3

1.4.3

Description

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

NVD description

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Mais vulnerabilidades de url-parse

Ver tudo →