---
title: "GHSA-9965-vmph-33xx: validator.js has a URL validation bypass vulnerability in its isURL function"
description: "Moderate severity. validator.js has a URL validation bypass vulnerability in its isURL function. Affects validator; fixed in 13.15.20."
url: https://inlinr.com/advisories/GHSA-9965-vmph-33xx
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

Moderate Vulnerability GHSA-9965-vmph-33xx CVE-2025-56200 Published 30 Sep 2025

# validator.js has a URL validation bypass vulnerability in its isURL function

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 13.x 13.0.0 – 13.15.15 Fixed in 13.15.20
- 12.x and older 0.1.0 – 12.2.0 No fix, no longer updated

On 13.x, the newest line:

```
npm install validator@13.15.20
```

Every release on a timeline

13.x 

1. Affected

13.0.0 – 13.15.15  
14 releases
2. Fixed

13.15.20 – 13.15.35  
5 releases, latest

12.x 

1. Affected

12.0.0 – 12.2.0  
3 releases

11.x 

1. Affected

11.0.0 – 11.1.0  
2 releases

10.x 

1. Affected

10.0.0 – 10.11.0  
13 releases

9.x 

1. Affected

9.0.0 – 9.4.1  
8 releases

8.x 

1. Affected

8.0.0 – 8.2.0  
3 releases

7.x 

1. Affected

7.0.0 – 7.2.0  
3 releases

6.x 

1. Affected

6.0.0 – 6.3.0  
5 releases

5.x 

1. Affected

5.0.0 – 5.7.0  
8 releases

4.x 

1. Affected

4.0.0 – 4.9.0  
21 releases

3.x 

1. Affected

3.0.0 – 3.43.0  
59 releases

2.x 

1. Affected

2.0.0 – 2.1.0  
2 releases

1.x 

1. Affected

1.0.0 – 1.5.1  
12 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20\. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

## How it is exploited

Exploitable over the network, with no account and a user to do something.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:R/​S:C/​C:L/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-56200 "https://nvd.nist.gov/vuln/detail/CVE-2025-56200")  
nvd.nist.gov/vuln/detail/CVE-2025-56200
- [Issue](https://github.com/validatorjs/validator.js/issues/2600 "https://github.com/validatorjs/validator.js/issues/2600")  
#2600
- [Pull request](https://github.com/validatorjs/validator.js/pull/2608 "https://github.com/validatorjs/validator.js/pull/2608")  
#2608
- [Fix commit](https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809 "https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809")  
cbef508
- [Reference](https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666 "https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666")  
gist.github.com/junan-98/27ae092aa40e2a057d41a0…
- [Reference](https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 "https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596")  
gist.github.com/junan-98/a93130505b258b9e4ec9f3…
- [Package](https://github.com/validatorjs/validator.js "https://github.com/validatorjs/validator.js")  
github.com/validatorjs/validator.js
- [Reference](https://github.com/validatorjs/validator.js/releases/tag/13.15.20 "https://github.com/validatorjs/validator.js/releases/tag/13.15.20")  
github.com/validatorjs/validator.js/releases/ta…
- [Reference](http://validatorjs.com "http://validatorjs.com")  
validatorjs.com