validator (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package validator, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2025-12758 — CVSS 7.5 (high): Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in…
• CVE-2021-3765 — CVSS 7.5 (high): validator.js is vulnerable to Inefficient Regular Expression Complexity
• CVE-2013-7453 — CVSS 6.1 (medium): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related…
• CVE-2013-7454 — CVSS 6.1 (medium): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden…
• CVE-2014-9772 — CVSS 6.1 (medium): The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded…
• CVE-2013-7451 — CVSS 6.1 (medium): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
• CVE-2025-56200 — CVSS 6.1 (medium): A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to…
• CVE-2013-7452 — CVSS 6.1 (medium): The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted…