---
title: "validator 13.15.35"
description: "Latest published version of validator is 13.15.35, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/validator
lang: en
---

[Packages](https://inlinr.com/packages)

# validator

13.15.35 · 2 Apr 2026 MIT 35M / week [Repository](https://github.com/validatorjs/validator.js) [npm](https://www.npmjs.com/package/validator) [Atom feed](https://inlinr.com/packages/feed/validator)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/validator/upgrade)

LineNewestSecurity

- 13.x 13.15.35 Safe from 13.15.22 Latest line
- 12.x and older 12.2.0 86 open advisories, worst high  · last release Jan 2020, no longer updated [To 13.15.35](https://inlinr.com/packages/validator/upgrade/12.2.0-13.15.35)

## Latest releases

[All 215 releases](https://inlinr.com/packages/validator/releases)

1. 13.x · latest line
2. ### [13.15.35](https://inlinr.com/packages/validator/releases/13.15.35 "Open this release") [](https://github.com/validatorjs/validator.js/releases/tag/13.15.35 "Read this release where it was published")  
2 Apr 2026

  - `isISO31661Alpha2`/`isISO31661Alpha3`: add support for Kosovo (`XK` / `XXK`)
  - `isHexColor`: ignore non-object options [@yuna0831](https://github.com/yuna0831)
  - **isTaxID:** improve `pt-BR` locale by adding support for alphanumeric CNPJ format [@easedu](https://github.com/easedu)
3. ### [13.15.26](https://inlinr.com/packages/validator/releases/13.15.26 "Open this release") [](https://github.com/validatorjs/validator.js/releases/tag/13.15.26 "Read this release where it was published")  
18 Dec 2025

  - `isHexColor`: add `require_hashtag` option [@Numbers0689](https://github.com/Numbers0689)
  - `isURL`: handle possible bypass with URL-encoded content [@WikiRik](https://github.com/WikiRik)
  - `isIBAN`: improve `IR` locale [@ds1371dani](https://github.com/ds1371dani)
4. ### [13.15.23](https://inlinr.com/packages/validator/releases/13.15.23 "Open this release") [](https://github.com/validatorjs/validator.js/releases/tag/13.15.23 "Read this release where it was published")  
10 Nov 2025

  - Doc fixes and others:

Dependency tracking · free for 3 projects

## Know when your own dependencies move

validator had 1 security advisory in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[All 10](https://inlinr.com/packages/validator/security)

- [Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements](https://inlinr.com/advisories/GHSA-vghf-hv5q-vc2g) High · fixed in 13.15.22
- [Regular Expression Denial of Service in validator](https://inlinr.com/advisories/GHSA-f5w6-r7rg-mcgq) High · fixed in 3.22.1
- [validator.js has a URL validation bypass vulnerability in its isURL function](https://inlinr.com/advisories/GHSA-9965-vmph-33xx) Moderate · fixed in 13.15.20

## Health

[Details](https://inlinr.com/packages/validator/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Reading releases, release notes and advisories…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.