CVE-2025-12758
Description
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
How to fix
- validator_project validator13.15.22 or later
- validator13.15.22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| validator_project validator | v < 13.15.22 | 13.15.22 |
| validatornpm | v < 13.15.22 | 13.15.22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.