CVE-2025-12758

HIGH EPSS 36.2%
Published Nov 27, 20257mo ago · Modified Jun 17, 20262w ago
7.7 CVSS 4.0
High
Find Similar
Published Nov 27, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
36.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-172
CWE-792

Affected Products 1

VendorProductVersionRange
validator_projectvalidator* <13.15.22

References 4

  • seclists.org http://seclists.org/fulldisclosure/2026/Jan/27
  • gist.github.com https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
    ExploitThird Party Advisory
  • github.com https://github.com/validatorjs/validator.js/pull/2616
    Issue TrackingPatch
  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/validatorjs/validator.js/pull/2616
    Issue TrackingPatch