---
title: "GHSA-vghf-hv5q-vc2g: Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements"
description: "High severity. Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements. Affects validator; fixed in 13.15.22."
url: https://inlinr.com/advisories/GHSA-vghf-hv5q-vc2g
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

High Vulnerability GHSA-vghf-hv5q-vc2g CVE-2025-12758 Published 27 Nov 2025

# Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 13.x 13.0.0 – 13.15.20 Fixed in 13.15.22
- 12.x and older 0.1.0 – 12.2.0 No fix, no longer updated

On 13.x, the newest line:

```
npm install validator@13.15.22
```

Every release on a timeline

13.x 

1. Affected

13.0.0 – 13.15.20  
15 releases
2. Fixed

13.15.22 – 13.15.35  
4 releases, latest

12.x 

1. Affected

12.0.0 – 12.2.0  
3 releases

11.x 

1. Affected

11.0.0 – 11.1.0  
2 releases

10.x 

1. Affected

10.0.0 – 10.11.0  
13 releases

9.x 

1. Affected

9.0.0 – 9.4.1  
8 releases

8.x 

1. Affected

8.0.0 – 8.2.0  
3 releases

7.x 

1. Affected

7.0.0 – 7.2.0  
3 releases

6.x 

1. Affected

6.0.0 – 6.3.0  
5 releases

5.x 

1. Affected

5.0.0 – 5.7.0  
8 releases

4.x 

1. Affected

4.0.0 – 4.9.0  
21 releases

3.x 

1. Affected

3.0.0 – 3.43.0  
59 releases

2.x 

1. Affected

2.0.0 – 2.1.0  
2 releases

1.x 

1. Affected

1.0.0 – 1.5.1  
12 releases

0.x 

1. Affected

0.1.0 – 0.5.0  
57 releases

215 stable releases of validator, oldest to newest, one row per major.

## What happens

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-12758 "https://nvd.nist.gov/vuln/detail/CVE-2025-12758")  
nvd.nist.gov/vuln/detail/CVE-2025-12758
- [Pull request](https://github.com/validatorjs/validator.js/pull/2616 "https://github.com/validatorjs/validator.js/pull/2616")  
#2616
- [Fix commit](https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382 "https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382")  
d457eca
- [Reference](https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e "https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e")  
gist.github.com/koral--/ad31208b25b9e3d1e2e35f1…
- [Package](https://github.com/validatorjs/validator.js "https://github.com/validatorjs/validator.js")  
github.com/validatorjs/validator.js
- [Reference](https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476 "https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476")  
security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
- [Reference](http://seclists.org/fulldisclosure/2026/Jan/27 "http://seclists.org/fulldisclosure/2026/Jan/27")  
seclists.org/fulldisclosure/2026/Jan/27