p PatchFirst

CVE-2025-12758

CVE-2025-12758

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • validator

    Versions
    • ≥ 0, < 13.15.22: Affected (semver)

    Update to 13.15.22

  • org.webjars.npm:validator

    Versions
    • ≥ 0, < 13.15.22: Affected (semver)

    Update to 13.15.22

  • validator npm

    Affected ranges
    • SEMVER: < 13.15.22

    Update to 13.15.22

Original sources

Check your server →