CVE-2021-3765: Inefficient Regular Expression Complexity in validator.js
Summary
CVE-2021-3765: Inefficient Regular Expression Complexity in validator.js. Affects validator versions < 13.7.0. Fixed in 13.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The validator package is an npm package used for data validation in JavaScript applications. It provides various functions for validating strings, numbers, emails, URLs, and more. The package is widely used in web development projects to ensure data integrity and security. However, prior to version 13.7.0, validator.js is vulnerable to an inefficient regular expression complexity issue.
Vulnerability Detail
The vulnerability in validator.js arises from inefficient regular expressions used in the validator.rtrim function. This can lead to excessive backtracking and cause the function to consume a significant amount of CPU resources, potentially resulting in denial-of-service attacks. An attacker could exploit this vulnerability by providing specially crafted input that triggers the inefficient regular expression, causing the application to become unresponsive or crash. The impact of this vulnerability is considered moderate.
How To Fix
Latest published version: 13.15.35 as of 23 Oct 2026
npm install validator@13.15.35Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13.7.0
This is the first release that contains the fix.
npm install validator@13.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the validator package to the fixed version to mitigate the risk.
Conclusion
In conclusion, the validator.js package prior to version 13.7.0 is vulnerable to an inefficient regular expression complexity issue. This can be exploited by attackers to cause denial-of-service attacks. To mitigate this risk, developers should update the package to version 13.7.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for validator →
FAQ
Validator.js is an npm package used for data validation in JavaScript applications. It provides functions for validating strings, numbers, emails, URLs, and more.
The vulnerability can lead to denial-of-service attacks by causing excessive CPU resource consumption. An attacker can exploit this to make the application unresponsive or crash.
Update the validator package to version 13.7.0 or later using the command npm install validator@latest.
No, there is no known workaround. Updating the package to the fixed version is the recommended solution.
There may be other vulnerabilities in validator.js that have not been disclosed or discovered yet. It is important to regularly update the package to ensure the latest security fixes are applied.
Related vulnerabilities
Recent vulnerabilities recorded for validator.
