diff --git a/index.js b/index.js
index 702308b..4cd646f 100644
--- a/index.js
+++ b/index.js
@@ -2,6 +2,7 @@
 
 var required = require('requires-port')
   , qs = require('querystringify')
+  , CRHTLF = /[\n\r\t]/g
   , slashes = /^[A-Za-z][A-Za-z0-9+-.]*:\/\//
   , protocolre = /^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i
   , windowsDriveLetter = /^[a-zA-Z]:/
@@ -135,6 +136,7 @@ function isSpecial(scheme) {
  */
 function extractProtocol(address, location) {
   address = trimLeft(address);
+  address = address.replace(CRHTLF, '');
   location = location || {};
 
   var match = protocolre.exec(address);
@@ -235,6 +237,7 @@ function resolve(relative, base) {
  */
 function Url(address, location, parser) {
   address = trimLeft(address);
+  address = address.replace(CRHTLF, '');
 
   if (!(this instanceof Url)) {
     return new Url(address, location, parser);
diff --git a/test/test.js b/test/test.js
index 8130081..2799280 100644
--- a/test/test.js
+++ b/test/test.js
@@ -102,7 +102,7 @@ describe('url-parse', function () {
     });
 
     it('does not truncate the input string', function () {
-      var input = 'foo\nbar\rbaz\u2028qux\u2029';
+      var input = 'foo\x0bbar\x0cbaz\u2028qux\u2029';
 
       assume(parse.extractProtocol(input)).eql({
         slashes: false,
@@ -113,7 +113,16 @@ describe('url-parse', function () {
     });
 
     it('trimsLeft', function () {
-      assume(parse.extractProtocol(' javascript://foo')).eql({
+      assume(parse.extractProtocol('\x0b\x0c javascript://foo')).eql({
+        slashes: true,
+        protocol: 'javascript:',
+        rest: 'foo',
+        slashesCount: 2
+      });
+    });
+
+    it('removes CR, HT, and LF', function () {
+      assume(parse.extractProtocol('jav\n\rasc\nript\r:/\t/fo\no')).eql({
         slashes: true,
         protocol: 'javascript:',
         rest: 'foo',
@@ -408,6 +417,31 @@ describe('url-parse', function () {
     assume(parsed.href).equals('//example.com');
   });
 
+  it('removes CR, HT, and LF', function () {
+    var parsed = parse(
+      'ht\ntp://a\rb:\tcd@exam\rple.com:80\t80/pat\thname?fo\no=b\rar#ba\tz'
+    );
+
+    assume(parsed.protocol).equals('http:');
+    assume(parsed.username).equals('ab');
+    assume(parsed.password).equals('cd');
+    assume(parsed.host).equals('example.com:8080');
+    assume(parsed.hostname).equals('example.com');
+    assume(parsed.port).equals('8080');
+    assume(parsed.pathname).equals('/pathname');
+    assume(parsed.query).equals('?foo=bar');
+    assume(parsed.hash).equals('#baz');
+    assume(parsed.href).equals(
+      'http://ab:cd@example.com:8080/pathname?foo=bar#baz'
+    );
+
+    parsed = parse('s\nip:al\rice@atl\tanta.com');
+
+    assume(parsed.protocol).equals('sip:');
+    assume(parsed.pathname).equals('alice@atlanta.com');
+    assume(parsed.href).equals('sip:alice@atlanta.com');
+  });
+
   describe('origin', function () {
     it('generates an origin property', function () {
       var url = 'http://google.com:80/pathname'