Debian 10 Buster DLA-3336-1 Critical: Node-Url-Parse Authorization Bypass

Multiple vulnerabilities were found in node-types-url-parse, a Node.js
module used to parse URLs, which may result in authorization bypass or
redirection to untrusted sites.

CVE-2021-3664

url-parse mishandles certain uses of a single (back)slash such as
https:\ & https:/ and interprets the URI as a relative path.
Browsers accept a single backslash after the protocol, and treat it
as a normal slash, while url-parse sees it as a relative path.
Depending on library usage, this may result in allow/block list
bypasses, SSRF attacks, open redirects, or other undesired behavior.

CVE-2021-27515

Using backslash in the protocol is valid in the browser, while
url-parse thinks it's a relative path. An application that
validates a URL using url-parse might pass a malicious link.

CVE-2022-0512

Incorrect handling of username and password can lead to failure to
properly identify the hostname, which in turn could result in
authorization bypass.

CVE-2022-0639