Inefficient Regular Expression Complexity in validator.js

Description

validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity

Recommendation

Update the validator package to the latest compatible version. Followings are version details:

• Affected version(s): < 13.7.0
• Patched version(s): 13.7.0

References

• GHSA-qgmg-gppg-76g5
• huntr.dev
• CVE-2021-3765
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• node-forge is vulnerable to ASN.1 OID Integer Truncation - CVE-2025-66030
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
• undici Denial of Service attack via bad certificate data - CVE-2025-47279

Tags:

npm

validator