# CVE-2022-0639: url-parse incorrect URL parsing with @ symbol

Source: https://junglewise.ai/threats/cve-2022-0639-url-parse-incorrect-url-parsing-with-symbol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-0639 · Severity: low · CVSS 3 · Published 2022-02-18

url-parse is a widely-used JavaScript library for parsing URLs into components (hostname, port, pathname, etc.). A specially crafted URL containing an '@' symbol can cause the library to incorrectly parse the URL structure, potentially returning a valid href when the input was malformed. If an application uses the parsed hostname or origin to make security decisions but then uses the href to make an actual request, an attacker could bypass those security checks.

Technologies: [url-parse (npm)](https://junglewise.ai/threats/technologies/url-parse). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-0639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0639 being exploited in the wild.

**How severe is CVE-2022-0639?** Low severity, with a CVSS score of 3, published 18 February 2022.

**Which products and versions are affected?** url-parse (npm) SEMVER:introduced=1.0.0,fixed=1.5.7.

**Is there a fix for CVE-2022-0639?** Yes. url-parse (npm): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0639 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-0639?** Check whether you run url-parse (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- url-parse (npm): upgrade to 1.5.7 or later

  ```sh
  npm install url-parse@1.5.7
  ```


## Technical details

url-parse incorrectly handles URLs with an '@' character where userinfo is empty and hostname is missing, such as "http://@/127.0.0.1". The vulnerability is a URL parsing bypass due to CWE-639 (authorization bypass through user-controlled key). When such a URL is parsed, the library returns an empty hostname and origin but a non-empty href, potentially transforming an invalid URL into a valid one. If security logic relies on the hostname or origin field to validate a URL, an attacker can craft a specially-formed URL that passes validation but results in a different target when the href is used to make a request. The fix, committed to version 1.5.7, re-adds empty userinfo to the href when appropriate to preserve the original invalid URL structure.

## Affected products

- unshiftio url-parse 1.0.0 through 1.5.6

## Identifiers

- CVE-2022-0639
- GHSA-8v38-pw62-9cw2

## Timeline

- 2022-02-18: disclosed
- 2022-02-22: patched: Fix committed; version 1.5.7 released

## References

- [https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788](https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788)

## Related threats

- [url-parse hostname/protocol parsing bypass via control characters](https://junglewise.ai/threats/cve-2022-0691-url-parse-hostname-protocol-parsing-bypass-via-control-characters)
- [url-parse authorization bypass through user-controlled key](https://junglewise.ai/threats/cve-2022-0686-url-parse-authorization-bypass-through-user-controlled-key)
- [url-parse authorization bypass in userinfo parsing](https://junglewise.ai/threats/cve-2022-0512-url-parse-authorization-bypass-in-userinfo-parsing)
- [npm url-parse improper validation in hostname parsing](https://junglewise.ai/threats/cve-2020-8124-npm-url-parse-improper-validation-in-hostname-parsing)
- [url-parse open redirect vulnerability](https://junglewise.ai/threats/cve-2021-3664-url-parse-open-redirect-vulnerability)