Inefficient Regular Expression Complexity in Validator.js
Summary
GHSA-xx4c-jj58-r7x6: Inefficient Regular Expression Complexity in Validator.js. Affects validator versions >= 11.1.0, < 13.7.0. Fixed in 13.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Validator.js is an npm package that provides a set of string validation and sanitization functions. It is commonly used in JavaScript applications to validate user input and sanitize data. The package offers various functions, including rtrim and trim, which are used to remove whitespace from the beginning and end of a string. However, versions of Validator.js prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using these sanitizers.
Vulnerability Detail
The inefficient Regular Expression complexity in Validator.js can lead to performance issues and potential denial-of-service (DoS) attacks. When using the rtrim and trim sanitizers, the Regular Expression used to remove whitespace from the string can have exponential time complexity, making it vulnerable to input strings that trigger excessive backtracking. An attacker could exploit this vulnerability by providing a specially crafted input that causes the Regular Expression engine to spend an excessive amount of time matching the pattern, resulting in a significant impact on the application's performance.
How To Fix
Latest published version: 13.15.35 as of 23 Oct 2026
npm install validator@13.15.35Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13.7.0
This is the first release that contains the fix.
npm install validator@13.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Validator.js package is not feasible at the moment, a possible workaround is to implement custom sanitization functions that do not rely on Regular Expressions with exponential time complexity. For example, instead of using rtrim and trim, developers can write their own functions to remove whitespace from the beginning and end of a string using more efficient algorithms.
Conclusion
Inefficient Regular Expression complexity in Validator.js versions prior to 13.7.0 can lead to performance issues and potential DoS attacks. It is crucial to update the package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for validator →
FAQ
Validator.js is an npm package used for string validation and sanitization in JavaScript applications.
Versions of Validator.js prior to 13.7.0 are affected by the inefficient Regular Expression complexity vulnerability.
The vulnerability can result in performance issues and potential denial-of-service (DoS) attacks.
To fix this vulnerability, update the Validator.js package to version 13.7.0 or later.
If updating the package is not feasible, developers can implement custom sanitization functions that do not rely on inefficient Regular Expressions.
References
Related vulnerabilities
Recent vulnerabilities recorded for validator.
