EUVD-2018-0418

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Incorrect parsing in url-parse <1.4.3 leads to SSF, Open Redirect, and Authentication Bypass vulnerabilities

Reporter	Title	Published	Views	Family All 29
CVE	CVE-2018-3774	12 Aug 201822:00	–	cve
Cvelist	CVE-2018-3774	12 Aug 201822:00	–	cvelist
Debian CVE	CVE-2018-3774	12 Aug 201822:00	–	debiancve
Github Security Blog	Open Redirect in url-parse	13 Aug 201815:02	–	github
Hacker One	Node.js third-party modules: url-parse package return wrong hostname	19 Jul 201809:49	–	hackerone
Hacker One	curl: SSRF via maliciously crafted URL due to host confusion	1 Oct 201902:48	–	hackerone
Node.js	Open Redirect	2 Aug 201815:02	–	nodejs
NVD	CVE-2018-3774	12 Aug 201822:29	–	nvd
OpenVAS	Ubuntu: Security Advisory (USN-5973-1)	28 Mar 202300:00	–	openvas
OSV	DEBIAN-CVE-2018-3774	12 Aug 201822:29	–	osv

[
  {
    "enisaIdVendor": [
      {
        "id": "8f9e29dc-1656-3b07-9d96-7279c2e7324a",
        "vendor": {
          "name": "HackerOne"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "b6fa2542-fd54-3ca9-abee-b58a17fb27c9",
        "product": {
          "name": "url-parse"
        },
        "product_version": "1.4.3"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-3774
github	www.github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5a
github	www.github.com/unshiftio/url-parse/commit/d7b582ec1243e8024e60ac0b62d2569c939ef5de
hackerone	www.hackerone.com/reports/384029
github	www.github.com/advisories/GHSA-pv4c-p2j5-38j4
npmjs	www.npmjs.com/advisories/678
access	www.access.redhat.com/errata/RHSA-2021:3917
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

8.9High risk

Vulners AI Score8.9

CVSS 310

CVSS 27.5

EPSS0.01747