Packages / validator / Security

HighVulnerabilityGHSA-vghf-hv5q-vc2gCVE-2025-12758Published 27 Nov 2025

Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

Your version

Affected releases · validator

  • 13.x13.0.0 – 13.15.20Fixed in 13.15.22
  • 12.x and older0.1.0 – 12.2.0No fix, no longer updated

On 13.x, the newest line:

npm install validator@13.15.22
Every release on a timeline
13.x

  1. Affected

    13.0.0 – 13.15.20

    15 releases

  2. Fixed

    13.15.22 – 13.15.35

    4 releases, latest

12.x

  1. Affected

    12.0.0 – 12.2.0

    3 releases

11.x

  1. Affected

    11.0.0 – 11.1.0

    2 releases

10.x

  1. Affected

    10.0.0 – 10.11.0

    13 releases

9.x

  1. Affected

    9.0.0 – 9.4.1

    8 releases

8.x

  1. Affected

    8.0.0 – 8.2.0

    3 releases

7.x

  1. Affected

    7.0.0 – 7.2.0

    3 releases

6.x

  1. Affected

    6.0.0 – 6.3.0

    5 releases

5.x

  1. Affected

    5.0.0 – 5.7.0

    8 releases

4.x

  1. Affected

    4.0.0 – 4.9.0

    21 releases

3.x

  1. Affected

    3.0.0 – 3.43.0

    59 releases

2.x

  1. Affected

    2.0.0 – 2.1.0

    2 releases

1.x

  1. Affected

    1.0.0 – 1.5.1

    12 releases

0.x

  1. Affected

    0.1.0 – 0.5.0

    57 releases

215 stable releases of validator, oldest to newest, one row per major.

What happens

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.