# CVE-2021-3765: validator.js inefficient regular expression complexity

Source: https://junglewise.ai/threats/cve-2021-3765-validator-js-inefficient-regular-expression-complexity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-3765 · Severity: low · CVSS 3 · Published 2021-11-03

validator.js is a widely-used input validation library for JavaScript. The library contains an inefficient regular expression in its string trimming function that can be exploited to cause a denial of service by making the library consume excessive CPU resources when processing specially crafted input strings.

Technologies: [validator (npm)](https://junglewise.ai/threats/technologies/npm-validator). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-3765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3765 being exploited in the wild.

**How severe is CVE-2021-3765?** Low severity, with a CVSS score of 3, published 3 November 2021.

**Which products and versions are affected?** validator (npm) SEMVER:introduced=0,fixed=13.7.0.

**Is there a fix for CVE-2021-3765?** Yes. validator (npm): upgrade to 13.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-3765 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-3765?** Check whether you run validator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- validator (npm): upgrade to 13.7.0 or later

  ```sh
  npm install validator@13.7.0
  ```


## Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) issue caused by an inefficient regular expression pattern in the rtrim function prior to version 13.7.0. The vulnerable regex exhibits catastrophic backtracking when processing certain malicious input patterns, allowing an attacker to cause the validation library to hang or consume significant CPU resources. The attack requires network access to an application using the affected version of validator.js, with no authentication required. The fix, committed in version 13.7.0, removes the problematic regex pattern in favor of a more efficient implementation. CWE-1333 (Inefficient Regular Expression Complexity).

## Affected products

- validatorjs validator.js prior to 13.7.0

## Identifiers

- CVE-2021-3765
- GHSA-qgmg-gppg-76g5

## Timeline

- 2021-11-03: disclosed
- 2021-11-03: patched: Fixed in version 13.7.0

## References

- [https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1](https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1)

## Related threats

- [validator.js improper length calculation in isLength function](https://junglewise.ai/threats/cve-2025-12758-validator-js-improper-length-calculation-in-islength-function)
- [validatorjs validator.js URL validation bypass in isURL](https://junglewise.ai/threats/cve-2025-56200-validatorjs-validator-js-url-validation-bypass-in-isurl)
- [Validator.js ReDoS in trim and rtrim sanitizers](https://junglewise.ai/threats/validator-js-redos-in-trim-and-rtrim-sanitizers-3960a1b8)
- [validator.js regular expression denial of service](https://junglewise.ai/threats/cve-2014-8882-validator-js-regular-expression-denial-of-service)
- [validator moderate severity vulnerability](https://junglewise.ai/threats/validator-moderate-severity-vulnerability-d45d43ae)