validator
13.15.35 · 2 Apr 2026MIT35M / weekRepositorynpmAtom feed
Upgrading validator From 13.5.2 to 13.15.35
12 releases in betweennotes for 11
Reading releases, release notes and advisories…
- ?
- changes to make
- 4
- advisories fixed
- 231+
- new
- 39+
- fixes
Counted from 11 of 12 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 4 advisories affecting 13.5.2
- validator.js has a URL validation bypass vulnerability in its isURL functionmoderate · GHSA-9965-vmph-33xx
- Inefficient Regular Expression Complexity in validator.jsmoderate · GHSA-qgmg-gppg-76g5
- Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elementshigh · GHSA-vghf-hv5q-vc2g
- Inefficient Regular Expression Complexity in Validator.jsmoderate · GHSA-xx4c-jj58-r7x6
- 13.15.20
isURL: improve protocol detection. Resolves CVE-2025-56200 @theofidry - 13.7.0
trim: remove regex to prevent ReDOS attack @tux-tn
Release by release
- new
isISO31661Alpha2/isISO31661Alpha3: add support for Kosovo (XK/XXK) - new
isHexColor: ignore non-object options @yuna0831 - new
isTaxID: improve
pt-BRlocale by adding support for alphanumeric CNPJ format @easedu - new
isTaxID: improve
pt-BRlocale by adding support for formatted CPF values @easedu
- new
- security
isURL: improve protocol detection. Resolves CVE-2025-56200 @theofidry - new
isMobilePhone: addar-QAlocale @WardKhaddour - new
isAlpha/isAlphanuneric: add Indic locales (ta-IN,te-IN,kn-IN,ml-IN,gu-IN,pa-IN,or-IN) - new
isBase64: improve padding regex @KrayzeeKev - new
isVAT: improveFRlocale @iamAmer - fixed
- fixed
- security
- new
isMobilePhone: improve
el-CYlocale @rezk2ll - new
isMobilePhone: improve
pt-AOlocale @renaldodev - new
isMobilePhone: improve
ar-OMlocale @tomcastro - new
isIP: allow usage of option object @pixelbucket-dev
- new
- new
isISO31661Numeric@RobinvanderVliet - new
isULID@arafatkn - new
isISO15924@xDivisionByZerox - new
isMobilePhone: add
es-GTlocale @ignaciosuarezquilis
- new
- new
isAbaRouting@songyuew - new
isLicensePlateadd Pakistanien-PKlocale @anasshakil - new
isPortfix invalid leading zeros @anasshakil - new
isTaxIDadded Argentinaes-ARlocale @estefrare
- new
4 internal lines (docs, tests, tooling) left out.