[GHSA-pv4c-p2j5-38j4] Open Redirect in url-parse

[ljharb]

Updates

• Affected products

Comments
Versions 0.0.0 - 0.0.4 are NOT vulnerable - they use Node.js's built-in url.parse() which handles backslashes correctly. The vulnerability was introduced in 0.1.0 when custom URL parsing was added.

[Copilot]

Pull request overview

This PR updates a security advisory for the url-parse npm package to correct the affected version range. The vulnerability (CVE-2018-3774) was incorrectly listed as affecting all versions from 0 onwards, but actually only affects versions starting from 0.1.0, as versions 0.0.0-0.0.4 used Node.js's built-in url.parse() which handles backslashes correctly.

Changes:

• Updated the "introduced" version from "0" to "0.1.0" to accurately reflect when the vulnerability was introduced
• Updated the "modified" timestamp to reflect the advisory change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shelbyc]

Hi @ljharb, unshiftio/url-parse@0.0.4...0.1.0 agrees with you that custom URL parsing was added in 0.1.0.

[advisory-database]

Hi @ljharb! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!