PT-2025-48236 · Validator · Validator

Karol Wrótniak · Published 2025-11-27 · Updated 2026-01-29 · CVE-2025-12758

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions validator versions prior to 13.15.22

Description The package validator, in versions prior to 13.15.22, contains an issue related to incomplete filtering of special elements within the isLength() function. Specifically, the function does not properly account for Unicode variation selectors (e.g., uFE0F, uFE0E) when calculating string length. This can result in the function accepting strings that are longer than expected, potentially leading to data truncation, buffer overflows, or denial-of-service conditions. The issue stems from improper string length calculation.

Recommendations Update to validator version 13.15.22 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-172

CWE-792

Related Identifiers

CVE-2025-12758

GHSA-VGHF-HV5Q-VC2G

Affected Products

Validator

References · 15

• 🔥 https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476 · Exploit
• https://github.com/validatorjs/validator.js/pull/2616 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-12758 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-12758 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12758 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vghf-hv5q-vc2g · Vendor Advisory
• https://github.com/validatorjs/validator.js · Note
• https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382 · Note
• https://t.me/cveNotify/150334 · Telegram Post
• http://seclists.org/fulldisclosure/2026/Jan/27 · Note
• https://t.me/CVEtracker/38368 · Telegram Post
• https://t.me/cveNotify/144166 · Telegram Post
• https://twitter.com/CVEnew/status/1993912051651998011 · Twitter Post
• https://t.me/cveNotify/147141 · Telegram Post