# validator (npm) vulnerabilities 8 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 13.15.35 (Apr 2, 2026): no advisory affects it - Newest unaffected release: 13.15.35 (Apr 2, 2026), the latest release - Weekly downloads: 35.7M - Dependents: 39.5K - Releases: 218 since 0.1.0 (Jan 4, 2011) - Registry: https://www.npmjs.com/package/validator - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-12758: 0.1.0 to 13.15.20 (13.15.22 is outside it) - CVE-2025-56200: 0.1.0 to 13.15.15 (13.15.20 is outside it) - CVE-2021-3765: 0.1.0 to 13.6.0 (13.7.0 is outside it) - CVE-2014-9772: 0.1.0 to 1.5.1 (2.0.0 is outside it) - CVE-2013-7454: 0.1.0 to 1.0.0 (1.1.0 is outside it) - CVE-2013-7453: 0.1.0 to 1.0.0 (1.1.0 is outside it) - CVE-2013-7452: 0.1.0 to 1.0.0 (1.1.0 is outside it) - CVE-2013-7451: 0.1.0 to 1.0.0 (1.1.0 is outside it) ## Advisories (8) ### [CVE-2025-12758](https://cve.now/CVE-2025-12758): Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in… - Severity: High 8.7 - Published: Nov 27, 2025 - Affected: fixed in 13.15.22. - Fixed in 13.15.22 (released Nov 9, 2025, 18 days before disclosure). - The latest release, 13.15.35, is not affected. - 32% of validator downloads last week were affected versions (13.1M). ### [CVE-2025-56200](https://cve.now/CVE-2025-56200): A URL validation bypass vulnerability exists in validator.js through version 13.15.15. - Severity: Medium 6.1 - Published: Sep 30, 2025 - Affected: fixed in 13.15.20. - Fixed in 13.15.20 (released Oct 26, 2025, 26 days after disclosure). - The latest release, 13.15.35, is not affected. - 29% of validator downloads last week were affected versions (11.7M). ### [CVE-2021-3765](https://cve.now/CVE-2021-3765): Inefficient Regular Expression Complexity in validatorjs/validator.js - Severity: Medium 5.3 - Published: Nov 2, 2021 - Affected: fixed in 13.7.0. - Fixed in 13.7.0 (released Nov 1, 2021, 1 day before disclosure). - The latest release, 13.15.35, is not affected. - 6.4% of validator downloads last week were affected versions (2.6M). ### [CVE-2014-9772](https://cve.now/CVE-2014-9772): The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded… - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 2.0.0. - Fixed in 2.0.0 (released Oct 31, 2013, 1180 days before disclosure). - The latest release, 13.15.35, is not affected. - <0.1% of validator downloads last week were affected versions (6.1K). ### [CVE-2013-7454](https://cve.now/CVE-2013-7454): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden… - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure). - The latest release, 13.15.35, is not affected. - <0.1% of validator downloads last week were affected versions (2.9K). ### [CVE-2013-7453](https://cve.now/CVE-2013-7453): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related… - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure). - The latest release, 13.15.35, is not affected. - <0.1% of validator downloads last week were affected versions (2.9K). ### [CVE-2013-7452](https://cve.now/CVE-2013-7452): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted… - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure). - The latest release, 13.15.35, is not affected. - <0.1% of validator downloads last week were affected versions (2.9K). ### [CVE-2013-7451](https://cve.now/CVE-2013-7451): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag. - Severity: Unrated - Published: Jan 23, 2017 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Apr 18, 2013, 1376 days before disclosure). - The latest release, 13.15.35, is not affected. - <0.1% of validator downloads last week were affected versions (2.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/validator Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.