url-parse
NPM Package
Vulnerability Check
Small footprint URL parser that works seamlessly across Node.js and browser environments
url-parse
Advisory Breakdown
Severity Rating
Critical8 advisories
Critical
Weekly downloads
39,648,837
Total advisories
8
Latest version
1.5.10
License
MIT
Known advisories
OSV records for the npm ecosystem
Improper Validation and Sanitization in url-parse
url-parse Incorrectly parses URLs that include an '@'
Path traversal in url-parse
Authorization Bypass Through User-Controlled Key in url-parse
Open redirect in url-parse
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.
Open Redirect in url-parse
Authorization bypass in url-parse
Checked Jun 15, 2026, 10:37 AM from npm and OSV.dev
Package metadata
From the npm registry
- Package name
- url-parse
- Ecosystem
- npm
- Latest version
- 1.5.10
- License
- MIT
- Weekly downloads
- 39,648,837
- Repository
- Open repository
Remediation boundary
What RequestGuard does — and doesn't — cover
RequestGuard does not fix npm package vulnerabilities. Dependency remediation happens through package updates, patches, lockfile changes, and maintainer guidance. RequestGuard can help mitigate runtime abuse around exposed web and API flows while remediation is handled separately.
Data from npm registry and OSV.dev · Checked 6/15/2026, 10:37:27 AM