validator
13.15.35 · 2 Apr 2026MIT35M / weekRepositorynpmAtom feed
13.15.35 is the newest release of 13.x.
In short
1 security58 new1 fixed1 internal
Security
Fixes 2 advisories that affected 13.6.0
- ModerateInefficient Regular Expression Complexity in Validator.jsGHSA-xx4c-jj58-r7x6 · 19 Nov 2021Fixed in 13.7.0
- ModerateInefficient Regular Expression Complexity in validator.jsGHSA-qgmg-gppg-76g5 · 3 Nov 2021Fixed in 13.7.0
2 advisories affect 13.7.0; 13.15.22 fixes them
- HighValidator is Vulnerable to Incomplete Filtering of One or More Instances of Special ElementsGHSA-vghf-hv5q-vc2g · 27 Nov 2025Fixed in 13.15.22
- Moderatevalidator.js has a URL validation bypass vulnerability in its isURL functionGHSA-9965-vmph-33xx · 30 Sep 2025Fixed in 13.15.20
Release note
New Features
isISO4217, currency code validator @jpaya17
Fixes and Enhancements
isFQDN: addallow_wildcardoption @fasenderosisRFC3339: Disallow prepended and appended strings to RFC 3339 date-time @jmacmahonmaintenance: Increase code coverage @tux-tn
IBANexport list of country codes that implement IBAN @dror-heller @fedeciisBoolean: addlooseoption @brybrophymaintenance: Fix npm installation error @rubiin
isISO31661Alpha3: perf @jpaya17isDate: allow users to strictly validate dates with.as delimiter @flymansisCreditCard: fix for Union Pay cards @shreyassai123isEmail: replace all dots in GMail length validation @DasDingGehtNichtisURL: addallow_fragmentsandallow_query_components@cowboy-bebugisISO31661Alpha2: perf @jpaya17isMagnetURI@tux-tn- security
trim: remove regex to prevent ReDOS attack @tux-tn maintenance: Run scripts in parallel for build and clean @sachinraja
isURL: higher priority towhitelist@deepanshu2506isURL: allow url with colon and no port @MatteoPierroisUUID: fix fornullversion argument @theteladrasisFQDN: check more special chars @MatteoPierroisURL: allow URL with an empty user @MiguelSavignanounescape: fixed bug where intermediate string contains escaped @Marcholiocontains: can check that string contains seed multiple times @MarcholioisUUID: add support for validation ofv1andv2@theteladrasisEmail: addhost_blacklistoption @fedeci
New and Improved Locales
isAlpha, isAlphanumeric:
hi-IN@MiKr13isAlpha, isAlphanumeric:
fi-FI@MarcholioisPassportNumber:
ID@rubiinisPassportNumber:
CN@anirudhgiriisPassportNumber:
PL@RonqnisPassportNumber:
RU@Theta-DevisPostalCode:
LK@nimanthadilzisIdentityCard:
TH@tithanayutisIdentityCard:
PL@wiktorwojcik112 @fedeci @tux-tnisIdentityCard:
LK@nimanthadilz @tux-tnisIdentityCard:
FI@MarcholioisMobilePhone:
de-DE@AnnaMariaJansenisMobilePhone:
vi-VN@luisrivasisMobilePhone:
es-VE@islasjuanpisMobilePhone:
nl-BE@divikshrivastavaisMobilePhone:
es-CU@pasagedevisMobilePhone:
es-SV, @herejeisMobilePhone:
ar-PS, @brendan-cisMobilePhone:
en-BM@HackProAITisMobilePhone:
dz-BT@lakshayr003isMobilePhone:
en-BW, @mgndolanisMobilePhone:
fr-CM@beckettnormingtonisMobilePhone:
en-PK@ammad20120 @tux-tnisMobilePhone:
tk-TM, @Husan-EshonqulovisMobilePhone:
en-GY, @mfkrauseisMobilePhone:
si-LK@Madhavi96isMobilePhone:
fr-PF, @herejeisMobilePhone:
en-KI, @c-tannerisMobilePhone:
hu-HU@danielTiringerisMobilePhone:
fr-BF,en-NA@lakshayr003isMobilePhone:
tg-TJ@mgnssisLicensePlate:
cs-CZ@filiptronicekisLicensePlate:
fi-FI@MarcholioisVAT:
NL@zeno4ever