p PatchFirst

CVE-2025-56200

CVE-2025-56200

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

CVSS 6.1 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • validator npm

    Affected ranges
    • SEMVER: < 13.15.20

    Update to 13.15.20

  • validator.js Ubuntu:16.04:LTS

    Versions
    • 3.17.0+dfsg1-1
    • 4.7.1+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • validator.js Ubuntu:18.04:LTS

    Versions
    • 4.7.1+dfsg1-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →