fixup! doc: deprecate url.parse()

nodejs · Oct 11, 2022 · 8c3fd95 · 8c3fd95
1 parent b555ee1
commit 8c3fd95
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/doc/api/url.md b/doc/api/url.md
@@ -1565,8 +1565,9 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
 
 `url.parse()` uses a lenient, non-standard algorithm for parsing URL
 strings. It is prone to security issues such as [host name spoofing][]
-and incorrect handling of usernames and passwords. Use the [WHATWG URL][] API
-instead.
+and incorrect handling of usernames and passwords. Do not use with untrusted
+input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
+[WHATWG URL][] API instead.
 
 ### `url.resolve(from, to)`