CVE-2022-25839

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

• CWE-20

• https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-URLJS-2414030Exploit, Patch, Third Party Advisory
• https://github.com/duzun/URL.js/commit/9dc9fcc99baa4cbda24403d81a589e9b0f4121d0Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-URLJS-2414030Exploit, Patch, Third Party Advisory

Published

Mar 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25832Improper authentication vulnerability in S Secure prior to S…6.8
• CVE-2022-25833Improper authentication in ImsService prior to SMR Apr-2022 …3.3
• CVE-2022-25834In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8…7.8
• CVE-2022-25836Bluetooth® Low Energy Pairing in Bluetooth Core Specificatio…7.5
• CVE-2022-25837Bluetooth® Pairing in Bluetooth Core Specification v1.0B thr…7.5
• CVE-2022-25838Laravel Fortify before 1.11.1 allows reuse within a short ti…8.1
• CVE-2022-2584The dag-pb codec can panic when decoding invalid blocks.7.5
• CVE-2022-25841Uncontrolled search path elements in the Intel(R) Datacenter…7.8
• CVE-2022-25842All versions of package com.alibaba.oneagent:one-java-agent-…9.8
• CVE-2022-25844The package angular after 1.7.0 are vulnerable to Regular Ex…7.5
• CVE-2022-25845The package com.alibaba:fastjson before 1.2.83 are vulnerabl…9.8
• CVE-2022-25847All versions of the package serve-lite are vulnerable to Cro…6.1