---
title: "GHSA-qgmg-gppg-76g5: Inefficient Regular Expression Complexity in validator.js"
description: "Moderate severity. Inefficient Regular Expression Complexity in validator.js. Affects validator; fixed in 13.7.0."
url: https://inlinr.com/advisories/GHSA-qgmg-gppg-76g5
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

Moderate Vulnerability GHSA-qgmg-gppg-76g5 CVE-2021-3765 Published 3 Nov 2021

# Inefficient Regular Expression Complexity in validator.js

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 13.x 13.0.0 – 13.6.0 Fixed in 13.7.0
- 12.x and older 0.1.0 – 12.2.0 No fix, no longer updated

On 13.x, the newest line:

```
npm install validator@13.7.0
```

Every release on a timeline

13.x 

1. Affected

13.0.0 – 13.6.0  
8 releases
2. Fixed

13.7.0 – 13.15.35  
11 releases, latest

12.x 

1. Affected

12.0.0 – 12.2.0  
3 releases

11.x 

1. Affected

11.0.0 – 11.1.0  
2 releases

10.x 

1. Affected

10.0.0 – 10.11.0  
13 releases

9.x 

1. Affected

9.0.0 – 9.4.1  
8 releases

8.x 

1. Affected

8.0.0 – 8.2.0  
3 releases

7.x 

1. Affected

7.0.0 – 7.2.0  
3 releases

6.x 

1. Affected

6.0.0 – 6.3.0  
5 releases

5.x 

1. Affected

5.0.0 – 5.7.0  
8 releases

4.x 

1. Affected

4.0.0 – 4.9.0  
21 releases

3.x 

1. Affected

3.0.0 – 3.43.0  
59 releases

2.x 

1. Affected

2.0.0 – 2.1.0  
2 releases

1.x 

1. Affected

1.0.0 – 1.5.1  
12 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-3765 "https://nvd.nist.gov/vuln/detail/CVE-2021-3765")  
nvd.nist.gov/vuln/detail/CVE-2021-3765
- [Fix commit](https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1 "https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1")  
496fc8b
- [Package](https://github.com/validatorjs/validator.js "https://github.com/validatorjs/validator.js")  
github.com/validatorjs/validator.js
- [Reference](https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9 "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9")  
huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d6…