CVE-2025-12758: Validator Package Vulnerable to Incomplete Filtering of Special Elements
Summary
CVE-2025-12758: Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements. Affects validator versions < 13.15.22. Fixed in 13.15.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'validator' package is a widely used library in the Node.js ecosystem that provides a set of string validation and sanitization functions. It is commonly utilized in web applications to ensure that user inputs conform to expected formats, thereby enhancing security and data integrity. However, certain versions of this package are susceptible to a vulnerability that affects the isLength() function, which can lead to improper string length calculations.
Vulnerability Detail
The vulnerability arises from the isLength() function in the validator package, which fails to account for Unicode variation selectors (\uFE0F, \uFE0E) when calculating string lengths. This oversight can allow applications to accept strings that are significantly longer than intended, potentially leading to issues such as data truncation in databases, buffer overflows in other system components, or denial-of-service attacks. The vulnerability is present in all versions prior to 13.15.22.
How To Fix
Latest published version: 13.15.35 as of 23 Oct 2026
npm install validator@13.15.35Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13.15.22
This is the first release that contains the fix.
npm install validator@13.15.22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional input validation logic in your application to manually check for and handle Unicode variation selectors before passing strings to the isLength() function. For example, you can use a regular expression to strip these characters from the input:
const sanitizedInput =
input.
replace(/[️︎]/g, '');
Conclusion
The validator package has a significant vulnerability that can lead to serious security issues if not addressed. It is crucial for developers to update to the patched version 13.15.22 or later to mitigate risks. Additionally, employing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for validator →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of the validator package prior to 13.15.22 are affected by this vulnerability.
The consequences include improper string length calculations, which can lead to data truncation, buffer overflows, or denial-of-service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement a workaround by sanitizing inputs to remove Unicode variation selectors before validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for validator.
