# CVE-2022-0512: url-parse authorization bypass in userinfo parsing

Source: https://junglewise.ai/threats/cve-2022-0512-url-parse-authorization-bypass-in-userinfo-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-0512 · Severity: low · CVSS 3.1 · Published 2022-02-15

url-parse is a JavaScript library used to parse and manipulate URLs. A flaw in how the library handles special characters (the '@' symbol) in the username/password portion of URLs allows an attacker to bypass authorization checks by crafting a malicious URL. This could enable attackers to spoof authentication credentials or redirect API calls to unintended targets.

Technologies: [url-parse (npm)](https://junglewise.ai/threats/technologies/url-parse). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-0512 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0512 being exploited in the wild.

**How severe is CVE-2022-0512?** Low severity, with a CVSS score of 3.1, published 15 February 2022.

**Which products and versions are affected?** url-parse (npm) SEMVER:introduced=0.1.0,fixed=1.5.6.

**Is there a fix for CVE-2022-0512?** Yes. url-parse (npm): upgrade to 1.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0512 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-0512?** Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- url-parse (npm): upgrade to 1.5.6 or later

  ```sh
  npm install url-parse@1.5.6
  ```


## Technical details

The vulnerability is an authorization bypass (CWE-639) in the userinfo (username:password) parsing logic of url-parse. The root cause is incorrect handling of the '@' character within credentials—the library used indexOf() instead of lastIndexOf() for '@', causing it to split the URL at the wrong position when '@' appears in the username or password. An attacker can craft a malicious URL with an embedded '@' in the credentials to deceive the parser into misinterpreting the hostname and port, leading to authorization bypass. No user interaction or authentication is required; the flaw is triggered by network-reachable URL parsing. The fix was released in version 1.5.6, which correctly uses lastIndexOf() to find the rightmost '@' that separates credentials from the host.

## Affected products

- unshiftio url-parse prior to 1.5.6

## Identifiers

- CVE-2022-0512
- GHSA-rqff-837h-mm52

## Timeline

- 2022-02-15: disclosed
- 2022-01-30: patched: Fix committed to repository
- 2022-02-14: other: CVE-2022-0512 published by NVD

## References

- [https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40](https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40)

## Related threats

- [url-parse hostname/protocol parsing bypass via control characters](https://junglewise.ai/threats/cve-2022-0691-url-parse-hostname-protocol-parsing-bypass-via-control-characters)
- [url-parse authorization bypass through user-controlled key](https://junglewise.ai/threats/cve-2022-0686-url-parse-authorization-bypass-through-user-controlled-key)
- [url-parse incorrect URL parsing with @ symbol](https://junglewise.ai/threats/cve-2022-0639-url-parse-incorrect-url-parsing-with-symbol)
- [npm url-parse improper validation in hostname parsing](https://junglewise.ai/threats/cve-2020-8124-npm-url-parse-improper-validation-in-hostname-parsing)
- [url-parse open redirect vulnerability](https://junglewise.ai/threats/cve-2021-3664-url-parse-open-redirect-vulnerability)