# CVE-2022-3224: parse-url hostname spoofing via incorrect URL parsing

Source: https://junglewise.ai/threats/cve-2022-3224-parse-url-hostname-spoofing-via-incorrect-url-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-3224 · Severity: low · CVSS 3.1 · Published 2022-09-16

parse-url is a popular npm library used to parse and normalize URLs in Node.js applications. The library incorrectly parses certain HTTP and HTTPS URLs, misidentifying the protocol as SSH and potentially spoofing hostnames. An attacker could exploit this by crafting malicious URLs to bypass URL validation, redirect traffic to attacker-controlled servers, or trick applications into connecting to wrong hosts.

Technologies: [parse-url (npm)](https://junglewise.ai/threats/technologies/parse-url). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-3224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-3224 being exploited in the wild.

**How severe is CVE-2022-3224?** Low severity, with a CVSS score of 3.1, published 16 September 2022.

**Which products and versions are affected?** parse-url (npm) SEMVER:introduced=0,fixed=8.1.0.

**Is there a fix for CVE-2022-3224?** Yes. parse-url (npm): upgrade to 8.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-3224 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-3224?** Check whether you run parse-url (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- parse-url (npm): upgrade to 8.1.0 or later

  ```sh
  npm install parse-url@8.1.0
  ```


## Technical details

parse-url prior to version 8.1.0 contains a misinterpretation of input vulnerability (CWE-115) in its URL parsing logic. The library fails to correctly parse certain HTTP or HTTPS URLs, sometimes identifying the protocol as SSH instead, and may also parse the hostname incorrectly. The vulnerability is triggered when processing specially crafted URLs and requires no authentication or special privileges. An attacker can exploit this by providing malicious URLs to an application that uses parse-url for validation or redirection, potentially causing hostname spoofing attacks. The fix was released in version 8.1.0.

## Affected products

- Ionic Bizau parse-url prior to 8.1.0

## Identifiers

- CVE-2022-3224
- GHSA-pqw5-jmp5-px4v

## Timeline

- 2022-09-16: disclosed: Advisory published
- 2022-09-16: patched: Version 8.1.0 released with fix

## References

- [https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e](https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e)

## Related threats

- [ionicabizau parse-url server-side request forgery](https://junglewise.ai/threats/cve-2022-2900-ionicabizau-parse-url-server-side-request-forgery)
- [parse-url cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2022-2217-parse-url-cross-site-scripting-vulnerability)
- [parse-url Server-Side Request Forgery](https://junglewise.ai/threats/cve-2022-2216-parse-url-server-side-request-forgery)
- [parse-url hostname confusion information disclosure](https://junglewise.ai/threats/cve-2022-0722-parse-url-hostname-confusion-information-disclosure)
- [parse-url cross-site scripting](https://junglewise.ai/threats/cve-2022-2218-parse-url-cross-site-scripting)