Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unshiftio/url-parse

              master @ 877225a
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

SSRF: 13 prior fixes. Scrutinize any change in this area.

index.js: most-fixed (21 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The library frequently suffered from parser differentials where malformed protocols with control characters, backslashes, or irregular slash counts allowed attackers to spoof hostnames or bypass allowlists, leading to SSRF. This is illustrated by CVE-2021-27515, CVE-2018-3774, and multiple targeted parser normalization patches.

Auth Bypass: Attackers can exploit discrepancies in user-controlled key parsing and protocol extraction to bypass authorization filters (such as leading whitespace bypasses on javascript: filters or misidentified file: schemas), as highlighted in multiple consecutive CVEs (CVE-2022-0691, CVE-2022-0686, CVE-2022-0639, CVE-2022-0512).

Request Smuggling: Failing to strip trailing control characters and whitespace from parsed URLs allows parsing discrepancies between intermediate proxies and backend web servers, creating opportunities for HTTP request smuggling.