Packages / validator / Security

ModerateVulnerabilityGHSA-9965-vmph-33xxCVE-2025-56200Published 30 Sep 2025

validator.js has a URL validation bypass vulnerability in its isURL function

Your version

Affected releases · validator

  • 13.x13.0.0 – 13.15.15Fixed in 13.15.20
  • 12.x and older0.1.0 – 12.2.0No fix, no longer updated

On 13.x, the newest line:

npm install validator@13.15.20
Every release on a timeline
13.x

  1. Affected

    13.0.0 – 13.15.15

    14 releases

  2. Fixed

    13.15.20 – 13.15.35

    5 releases, latest

12.x

  1. Affected

    12.0.0 – 12.2.0

    3 releases

11.x

  1. Affected

    11.0.0 – 11.1.0

    2 releases

10.x

  1. Affected

    10.0.0 – 10.11.0

    13 releases

9.x

  1. Affected

    9.0.0 – 9.4.1

    8 releases

8.x

  1. Affected

    8.0.0 – 8.2.0

    3 releases

7.x

  1. Affected

    7.0.0 – 7.2.0

    3 releases

6.x

  1. Affected

    6.0.0 – 6.3.0

    5 releases

5.x

  1. Affected

    5.0.0 – 5.7.0

    8 releases

4.x

  1. Affected

    4.0.0 – 4.9.0

    21 releases

3.x

  1. Affected

    3.0.0 – 3.43.0

    59 releases

2.x

  1. Affected

    2.0.0 – 2.1.0

    2 releases

1.x

  1. Affected

    1.0.0 – 1.5.1

    12 releases

0.x

  1. Affected

    0.1.0 – 0.5.0

    57 releases

215 stable releases of validator, oldest to newest, one row per major.

What happens

A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.