XSS Filter Bypass via Encoded URL in validator

Description

Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.

Recommendation

Update the validator package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-79mx-88w7-8f7q
• www.npmjs.com
• www.openwall.com
• www.securityfocus.com
• CVE-2014-9772
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
• Apostrophe has stored XSS via javascript: URL in Image Widget Link - CVE-2026-45011
• @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware - CVE-2026-29087

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

validator