validator
13.15.35 · 2 Apr 2026MIT35M / weekRepositorynpmAtom feed
Upgrading validator From 3.5.1 to 13.15.22
133 releases in betweennotes for 80
Reading releases, release notes and advisories…
Counted from 80 of 133 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking4.1.0
Security
Fixes 4 advisories affecting 3.5.1
- validator.js has a URL validation bypass vulnerability in its isURL functionmoderate · GHSA-9965-vmph-33xx
- Regular Expression Denial of Service in validatorhigh · GHSA-f5w6-r7rg-mcgq
- Inefficient Regular Expression Complexity in validator.jsmoderate · GHSA-qgmg-gppg-76g5
- Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elementshigh · GHSA-vghf-hv5q-vc2g
- 13.15.20
isURL: improve protocol detection. Resolves CVE-2025-56200 @theofidry - 13.7.0
trim: remove regex to prevent ReDOS attack @tux-tn - 9.4.1
Patched a REDOS vulnerability in
isDataURI - 4.0.5
Fixed a denial of service vulnerability in the
isEmail()regex
Release by release
- security
isURL: improve protocol detection. Resolves CVE-2025-56200 @theofidry - new
isMobilePhone: addar-QAlocale @WardKhaddour - new
isAlpha/isAlphanuneric: add Indic locales (ta-IN,te-IN,kn-IN,ml-IN,gu-IN,pa-IN,or-IN) - new
isBase64: improve padding regex @KrayzeeKev - new
isVAT: improveFRlocale @iamAmer - fixed
- fixed
- security
- new
isMobilePhone: improve
el-CYlocale @rezk2ll - new
isMobilePhone: improve
pt-AOlocale @renaldodev - new
isMobilePhone: improve
ar-OMlocale @tomcastro - new
isIP: allow usage of option object @pixelbucket-dev
- new
- new
isISO31661Numeric@RobinvanderVliet - new
isULID@arafatkn - new
isISO15924@xDivisionByZerox - new
isMobilePhone: add
es-GTlocale @ignaciosuarezquilis
- new
- new
isAbaRouting@songyuew - new
isLicensePlateadd Pakistanien-PKlocale @anasshakil - new
isPortfix invalid leading zeros @anasshakil - new
isTaxIDadded Argentinaes-ARlocale @estefrare
- new
- new
isFreightContainerID: for shipping containers IDs @songyuew - new
isMailtoURI@uksarkar - new
isIBANaddMAlocale @lroudge - new
isCreditCardrefactor @pano9000
- new
- new
isISO6391: add ISO 639-1 validator @braaar - new
isLuhnNumber@ST-DDT - new
isMACAddress: add EUI-validation @WikiRik @tux-tn - new
isBase32: add option for Crockford's base32 alternative @BigOsvaap
- new
- security
trim: remove regex to prevent ReDOS attack @tux-tn - new
isISO4217, currency code validator @jpaya17 - new
isFQDN: addallow_wildcardoption @fasenderos - new
isRFC3339: Disallow prepended and appended strings to RFC 3339 date-time @jmacmahon
- security
70 other lines we could not sort, mostly version bumps
- 13.5.1
New features:
isVAT#1463 - 13.5.1
New features:
isTaxID#1446 - 13.5.1
New features:
isBase58#1445 - 13.5.1
New features:
isStrongPassword#1348 - 13.5.1
Fixes and Enhancements:
isISO8601: addstrictSeparator@brostone51 - 13.5.1
Fixes and Enhancements:
isFQDN: make more strict @CristhianMotoche - 13.5.1
Fixes and Enhancements:
isFQDN:allow_underscoreoption @gibson042 - 13.5.1
Fixes and Enhancements:
isEmail: character blacklisting @rubiin - 13.5.1
Fixes and Enhancements:
isURL: addedrequire_portoption @yshanli - 13.5.1
Fixes and Enhancements:
isEmail: respectignore_max_lengthoption @evantahler
5 internal lines (docs, tests, tooling) left out.