---
title: "validator security advisories"
description: "10 known security advisories for validator, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/validator/security
lang: en
---

[Packages](https://inlinr.com/packages)

# validator

13.15.35 · 2 Apr 2026 MIT 35M / week [Repository](https://github.com/validatorjs/validator.js) [npm](https://www.npmjs.com/package/validator) [Atom feed](https://inlinr.com/packages/feed/validator)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest   | Where it stands                                                            |
| ---- | -------- | -------------------------------------------------------------------------- |
|      | 13.15.35 | Safe from 13.15.22                                                         |
|      | 12.2.0   | 86 open advisories, worst high  · last release Jan 2020, no longer updated |

- High  
[Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements](https://inlinr.com/advisories/GHSA-vghf-hv5q-vc2g)GHSA-vghf-hv5q-vc2g · 27 Nov 2025  
fixed in 13.15.22
- High  
[Regular Expression Denial of Service in validator](https://inlinr.com/advisories/GHSA-f5w6-r7rg-mcgq)GHSA-f5w6-r7rg-mcgq · 31 Aug 2020  
fixed in 3.22.1
- Moderate  
[validator.js has a URL validation bypass vulnerability in its isURL function](https://inlinr.com/advisories/GHSA-9965-vmph-33xx)GHSA-9965-vmph-33xx · 30 Sep 2025  
fixed in 13.15.20
- Moderate  
[Inefficient Regular Expression Complexity in Validator.js](https://inlinr.com/advisories/GHSA-xx4c-jj58-r7x6)GHSA-xx4c-jj58-r7x6 · 19 Nov 2021  
fixed in 13.7.0
- Moderate  
[Inefficient Regular Expression Complexity in validator.js](https://inlinr.com/advisories/GHSA-qgmg-gppg-76g5)GHSA-qgmg-gppg-76g5 · 3 Nov 2021  
fixed in 13.7.0
- Moderate  
[XSS Filter Bypass via Encoded URL in validator](https://inlinr.com/advisories/GHSA-79mx-88w7-8f7q)GHSA-79mx-88w7-8f7q · 6 Nov 2018
- Moderate  
[Moderate severity vulnerability that affects validator](https://inlinr.com/advisories/GHSA-552w-rqg8-gxxm)GHSA-552w-rqg8-gxxm · 24 Oct 2017  
fixed in 1.1.0
- Moderate  
[Multiple XSS Filter Bypasses in validator](https://inlinr.com/advisories/GHSA-q4qq-fm7q-cwp5)GHSA-q4qq-fm7q-cwp5 · 24 Oct 2017  
fixed in 1.1.0
- Moderate  
[Moderate severity vulnerability that affects validator](https://inlinr.com/advisories/GHSA-qpjp-7rp2-9c3f)GHSA-qpjp-7rp2-9c3f · 24 Oct 2017  
fixed in 1.1.0
- Moderate  
[Moderate severity vulnerability that affects validator](https://inlinr.com/advisories/GHSA-rh6c-q938-3r9q)GHSA-rh6c-q938-3r9q · 24 Oct 2017  
fixed in 1.1.0

### Quality and security signals

What [npm](https://www.npmjs.com/package/validator) and [deps.dev](https://deps.dev/npm/validator) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.