Read the docs
TI-2018-02768 Aliases CVE-2018-3774GHSA-pv4c-p2j5-38j4

Open redirect in HackerOne url-parse

Priority MEDIUM 49CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-425 and CWE-601.

Summary

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Why it matters now

EPSS 0.03805 90th percentileScored 2026-11-07
Fix Fixed url-parse (npm): 1.4.3Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOneurl-parse1.4.3—No fix listedCNA
—url-parse (npm)1.0.0 to before 1.4.31.4.3Patch availableGHSA-pv4c-p2j5-38j4
  • url-parse VendorHackerOne Affected 1.4.3 Fixed in — No fix listed CNA
  • url-parse (npm) Vendor— Affected 1.0.0 to before 1.4.3 Fixed in 1.4.3 Patch available GHSA-pv4c-p2j5-38j4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:url-parse_project:url-parse:*:*:*:*:*:*:*:*before 1.4.3Vulnerableunshiftio
  • cpe:2.3:o:url-parse_project:url-parse:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·unshiftio

Remediation

  • Fix · GHSA-pv4c-p2j5-38j4 url-parse (npm) Fixed in 1.4.3 Advisory →

Red Hat 1 advisory

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:3917
Not affected: 1 product
  • Quay v3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-3774
  2. 2026-10-03 Alias added: GHSA-pv4c-p2j5-38j4
  3. 2026-10-30 EPSS moved to the 90th–95th percentile

References

Advisory 4

Other 3

  • TI-2022-00605 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse CVSS 3.1CRITICAL 9.8
  • TI-2022-00600 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse CVSS 3.1CRITICAL 9.1
  • TI-2022-00432 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse CVSS 3.1MEDIUM 5.3
  • TI-2021-08995 url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path. CVSS 3.1MEDIUM 5.3
  • TI-2021-02606 Open Redirect in unshiftio/url-parse CVSS 3.1MEDIUM 5.3
  • TI-2022-00556 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences