Overview

Affected versions of npm url-parse are vulnerable to URL Redirection to Untrusted Site.

Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3664
• unshiftio/url-parse#205
• unshiftio/url-parse#206
• unshiftio/url-parse@81ab967
• https://huntr.dev/bounties/1625557993985-unshiftio/url-parse