url-parse Incorrectly parses URLs that include an '@'

🗓️ 18 Feb 2022 00:00:33Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 41 Views

url-parse Incorrectly Parses URL

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities	25 Jul 202213:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	16 Aug 202215:59	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
Huntr	in unshiftio/url-parse	14 Feb 202206:51	–	huntr
Circl	CVE-2022-0639	17 Feb 202220:37	–	circl
CNNVD	url-parse 安全漏洞	17 Feb 202200:00	–	cnnvd
CVE	CVE-2022-0639	17 Feb 202200:00	–	cve
Cvelist	CVE-2022-0639 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	17 Feb 202200:00	–	cvelist

Vulners

Node

url-parse_project url-parseRange1.0.0–1.5.7npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-0639
github	www.github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788
huntr	www.huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155
lists	www.lists.debian.org/debian-lts-announce/2023/02/msg00030.html
lists	www.lists.debian.org/debian-lts-announce/2025/12/msg00024.html
github	www.github.com/advisories/GHSA-8v38-pw62-9cw2

20 Feb 2026 19:56Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

CVSS 3.15.3

CVSS 36.5

EPSS0.00029

url-parse incorrect parsing security issue software