Is validator 13.6 vulnerable?

npm · 1 release from 13.6.0 to 13.6.0 · latest validator is 13.15.35 · checked 2 Nov 2026

Yes: 4 known advisories

Yes. validator 13.6.0, the last 13.6 release, is affected by 4 known security advisories (1 high, 3 medium), including CVE-2025-12758, CVE-2025-56200, CVE-2021-3765. Upgrade to 13.15.22 or later to fix all of them.

Upgrade with:npm install validator@13.15.22

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting validator 13.6.0

  • HighCVE-2025-12758GHSA-vghf-hv5q-vc2g27 Nov 2025

    Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

    Affected
    <13.15.22
    Fixed in
    13.15.22
  • MediumCVE-2025-56200GHSA-9965-vmph-33xx30 Sept 2025

    validator.js has a URL validation bypass vulnerability in its isURL function

    Affected
    <13.15.20
    Fixed in
    13.15.20
  • MediumGHSA-xx4c-jj58-r7x619 Nov 2021

    Inefficient Regular Expression Complexity in Validator.js

    Affected
    >=11.1.0 <13.7.0
    Fixed in
    13.7.0
  • MediumCVE-2021-3765GHSA-qgmg-gppg-76g53 Nov 2021

    Inefficient Regular Expression Complexity in validator.js

    Affected
    <13.7.0
    Fixed in
    13.7.0

Which of your client projects are still on validator 13.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact validator version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other validator versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.