Publish Advisories

GHSA-8v38-pw62-9cw2
GHSA-4vq8-7jfc-9cvp

Author: advisory-database[bot]

advisories/github-reviewed/2022/02/GHSA-8v38-pw62-9cw2/GHSA-8v38-pw62-9cw2.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8v38-pw62-9cw2",
-  "modified": "2023-09-11T22:51:42Z",
+  "modified": "2025-12-20T03:15:43Z",
   "published": "2022-02-18T00:00:33Z",
   "aliases": [
     "CVE-2022-0639"
   ],
   "summary": "url-parse Incorrectly parses URLs that include an '@'",
-  "details": "A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,\n\n```js\nparse(\\\"http://@/127.0.0.1\\\")\n```\nWill return:\n```yaml\n{\n slashes: true,\n protocol: 'http:',\n hash: '',\n query: '',\n pathname: '/127.0.0.1',\n auth: '',\n host: '',\n port: '',\n hostname: '',\n password: '',\n username: '',\n origin: 'null',\n href: 'http:///127.0.0.1'\n }\n```\nIf the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.\n",
+  "details": "A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,\n\n```js\nparse(\\\"http://@/127.0.0.1\\\")\n```\nWill return:\n```yaml\n{\n slashes: true,\n protocol: 'http:',\n hash: '',\n query: '',\n pathname: '/127.0.0.1',\n auth: '',\n host: '',\n port: '',\n hostname: '',\n password: '',\n username: '',\n origin: 'null',\n href: 'http:///127.0.0.1'\n }\n```\nIf the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -55,6 +55,10 @@
     {
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2025/12/msg00024.html"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2025/07/GHSA-4vq8-7jfc-9cvp/GHSA-4vq8-7jfc-9cvp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4vq8-7jfc-9cvp",
-  "modified": "2025-08-14T19:36:09Z",
+  "modified": "2025-12-20T03:14:48Z",
   "published": "2025-07-29T19:56:25Z",
   "aliases": [
     "CVE-2025-54410"