---
title: "GHSA-xx4c-jj58-r7x6: Inefficient Regular Expression Complexity in Validator.js"
description: "Moderate severity. Inefficient Regular Expression Complexity in Validator.js. Affects validator; fixed in 13.7.0."
url: https://inlinr.com/advisories/GHSA-xx4c-jj58-r7x6
lang: en
---

[Packages](https://inlinr.com/packages) / [validator](https://inlinr.com/packages/validator) / [Security](https://inlinr.com/packages/validator/security)

Moderate Vulnerability GHSA-xx4c-jj58-r7x6 Published 19 Nov 2021

# Inefficient Regular Expression Complexity in Validator.js

Your version 

Affected releases · [validator](https://inlinr.com/packages/validator)

- 13.x 13.0.0 – 13.6.0 Fixed in 13.7.0
- 12.x and older 11.1.0 – 12.2.0 No fix, no longer updated

On 13.x, the newest line:

```
npm install validator@13.7.0
```

Every release on a timeline

13.x 

1. Affected

13.0.0 – 13.6.0  
8 releases
2. Fixed

13.7.0 – 13.15.35  
11 releases, latest

12.x 

1. Affected

12.0.0 – 12.2.0  
3 releases

11.x 

1. Not affected

11.0.0  
1 release
2. Affected

11.1.0  
1 release

215 stable releases of validator, oldest to newest, one row per major.

## What happens

Impact

Versions of `validator` prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the `rtrim` and `trim` sanitizers.

Patches

The problem has been patched in validator 13.7.0

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/validatorjs/validator.js/security/advisories/GHSA-xx4c-jj58-r7x6 "https://github.com/validatorjs/validator.js/security/advisories/GHSA-xx4c-jj58-r7x6")  
github.com/validatorjs/validator.js/security/ad…
- [Related advisory](https://nvd.nist.gov/vuln/detail/CVE-2021-3765 "https://nvd.nist.gov/vuln/detail/CVE-2021-3765")  
nvd.nist.gov/vuln/detail/CVE-2021-3765
- [Issue](https://github.com/validatorjs/validator.js/issues/1599 "https://github.com/validatorjs/validator.js/issues/1599")  
#1599
- [Pull request](https://github.com/validatorjs/validator.js/pull/1738 "https://github.com/validatorjs/validator.js/pull/1738")  
#1738
- [Package](https://github.com/validatorjs/validator.js "https://github.com/validatorjs/validator.js")  
github.com/validatorjs/validator.js
- [Reference](https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9 "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9")  
huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d6…