Read the docs
TI-2025-11693 Aliases CVE-2025-12758GHSA-vghf-hv5q-vc2g

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering…

Priority HIGH 77CWE-792Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00554 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed validator: 13.15.22org.webjars.npm:validator: 13.15.22+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—validatorbefore 13.15.2213.15.22Patch availableCNA
—org.webjars.npm:validatorbefore 13.15.2213.15.22Patch availableCNA
—validator (npm)before 13.15.2213.15.22Patch availableGHSA-vghf-hv5q-vc2g
  • validator Vendor— Affected before 13.15.22 Fixed in 13.15.22 Patch available CNA
  • org.webjars.npm:validator Vendor— Affected before 13.15.22 Fixed in 13.15.22 Patch available CNA
  • validator (npm) Vendor— Affected before 13.15.22 Fixed in 13.15.22 Patch available GHSA-vghf-hv5q-vc2g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:validator_project:validator:*:*:*:*:*:node.js:*:*before 13.15.22VulnerableValidator Project
  • cpe:2.3:a:validator_project:validator:*:*:*:*:*:node.js:*:* Versions before 13.15.22 Vulnerable ·Validator Project

Remediation

  • Fix · CNA validator Fixed in 13.15.22
  • Fix · CNA org.webjars.npm:validator Fixed in 13.15.22
  • Fix · GHSA-vghf-hv5q-vc2g validator (npm) Fixed in 13.15.22 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12758
  2. 2026-10-03 Alias added: GHSA-vghf-hv5q-vc2g

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2021-02697 Inefficient Regular Expression Complexity in validatorjs/validator.js CVSS 3.1HIGH 7.5
  • TI-2025-35268 A URL validation bypass vulnerability exists in validator.js through version 13.15.15. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences