npmPackage

validator

8 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 13.15.35 (Apr 2, 2026): no advisory affects it
Newest unaffected release: 13.15.35 (Apr 2, 2026), the latest release
Advisories: 8 · 1 high, 2 medium

Weekly downloads: 35.7M
Dependents: 39.5K
Releases: 218 since 0.1.0 (Jan 4, 2011)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2025-12758
Affects 0.1.0 to 13.15.20 (13.15.22 is outside it)
CVE-2025-56200
Affects 0.1.0 to 13.15.15 (13.15.20 is outside it)
CVE-2021-3765
Affects 0.1.0 to 13.6.0 (13.7.0 is outside it)
CVE-2014-9772
Affects 0.1.0 to 1.5.1 (2.0.0 is outside it)
CVE-2013-7454
Affects 0.1.0 to 1.0.0 (1.1.0 is outside it)
CVE-2013-7453
Affects 0.1.0 to 1.0.0 (1.1.0 is outside it)
CVE-2013-7452
Affects 0.1.0 to 1.0.0 (1.1.0 is outside it)
CVE-2013-7451
Affects 0.1.0 to 1.0.0 (1.1.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2025-12758High 8.7
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in…
Affected: fixed in 13.15.22.
Fixed in 13.15.22 (released Nov 9, 2025, 18 days before disclosure).
The latest release, 13.15.35, is not affected.
32% of validator downloads last week were affected versions (13.1M).
CVE-2025-56200Medium 6.1
A URL validation bypass vulnerability exists in validator.js through version 13.15.15.
Affected: fixed in 13.15.20.
Fixed in 13.15.20 (released Oct 26, 2025, 26 days after disclosure).
The latest release, 13.15.35, is not affected.
29% of validator downloads last week were affected versions (11.7M).
CVE-2021-3765Medium 5.3
Inefficient Regular Expression Complexity in validatorjs/validator.js
Affected: fixed in 13.7.0.
Fixed in 13.7.0 (released Nov 1, 2021, 1 day before disclosure).
The latest release, 13.15.35, is not affected.
6.4% of validator downloads last week were affected versions (2.6M).
CVE-2014-9772Unrated
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded…
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released Oct 31, 2013, 1180 days before disclosure).
The latest release, 13.15.35, is not affected.
<0.1% of validator downloads last week were affected versions (6.1K).
CVE-2013-7454Unrated
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden…
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure).
The latest release, 13.15.35, is not affected.
<0.1% of validator downloads last week were affected versions (2.9K).
CVE-2013-7453Unrated
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related…
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure).
The latest release, 13.15.35, is not affected.
<0.1% of validator downloads last week were affected versions (2.9K).
CVE-2013-7452Unrated
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted…
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure).
The latest release, 13.15.35, is not affected.
<0.1% of validator downloads last week were affected versions (2.9K).
CVE-2013-7451Unrated
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure).
The latest release, 13.15.35, is not affected.
<0.1% of validator downloads last week were affected versions (2.9K).