Open Redirect in url-parse

严重 10.0CVE-2018-3774 · GHSA-pv4c-p2j5-38j4 · Published 12/08/2018 · updated 17/06/2026

要点

CVE-2018-3774 是影响 url-parse 的严重 (CVSS 10.0)漏洞。
未来 30 天内被利用的概率（EPSS）：3.8%，高于 90.0% 的漏洞。
修复：升级到 1.4.3 或更高版本。

Package	Affected versions	Patched versions
url-parse npm	`≥ 1.0.0, < 1.4.3`	`1.4.3`

Description

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

NVD description

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

References

nvd.nist.gov/vuln/detail/CVE-2018-3774 · ADVISORY
unshiftio/url-parse commit 209c296 · WEB
unshiftio/url-parse commit 53b1794 · WEB
unshiftio/url-parse commit d7b582e · WEB
hackerone.com/reports/384029 · WEB
unshiftio/url-parse · PACKAGE
unshiftio/url-parse · WEB

url-parse 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

url-parse

npm

≥ 1.0.0, < 1.4.3

1.4.3

Description

Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.

Recommendation

Update to version 1.4.3 or later.

NVD description

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

url-parse 的其他漏洞

查看全部 →