CVE-2018-3774
highpriority · track · 41EPSS 0.038 · 90 %ileEUUSEPSS · scored 2026-10-28
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-pv4c-p2j5-38j4Open Redirect in url-parse2018-08-13ghsa · osvUS
Versions of `url-parse` before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities. ## Recommendation Update to version 1.4.3 or later.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5acnnvd
- https://github.com/unshiftio/url-parse/commit/d7b582ec1243e8024e60ac0b62d2569c939ef5decnnvd
- https://hackerone.com/reports/384029cnnvd
- https://packetstormsecurity.com/files/164555/Red-Hat-Security-Advisory-2021-3917-01.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.3472cnnvd
- https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5aenisa_euvd
- https://github.com/unshiftio/url-parse/commit/d7b582ec1243e8024e60ac0b62d2569c939ef5deenisa_euvd
- https://hackerone.com/reports/384029enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan