← Vulnerability feed

Vulnerability record · CVE-2025-12758 · published 27 November 2025

CVE-2025-12758: Validator project validator vulnerability

Validator Project · Validator

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

7.7 CVSS 4.0 High EPSS 0.52% · top 58.4% CWE-792 · CWE-792CWE-172 · CWE-172
7.7CVSS 4.0 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 3 tagged exploit
14 Jul 2026Last modified by NVD

Description

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e ExploitThird Party Advisory
https://github.com/validatorjs/validator.js/pull/2616 Issue TrackingPatch
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011
https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476 ExploitThird Party Advisory
http://seclists.org/fulldisclosure/2026/Jan/27
https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476 ExploitThird Party Advisory

Track CVE-2025-12758 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-3765Validator project validator inefficient regular expression (redos) vulnerabilityvalidator.js is vulnerable to Inefficient Regular Expression ComplexityEPSS 1.8%6.1CVE-2025-56200Validator project validator cross-site scripting vulnerabilityA URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protoc…EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2025-12758), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.