Executive brief
The validator.js library, a popular tool used by developers to check and clean user-provided text, contains a flaw in how it calculates the length of certain characters. An attacker can bypass character limit restrictions by including specific hidden Unicode characters in their input. This could allow them to submit unexpectedly large amounts of data, potentially crashing the application, causing data to be cut off in databases, or creating other system instabilities.
Technical details
The validator.js library's isLength() function incorrectly handles Unicode variation selectors (\uFE0F and \uFE0E). The function's logic subtracts all instances of these selectors from the total string length regardless of their position, rather than only discounting them when they follow a base character as per the Unicode standard. A remote attacker can exploit this by embedding a large number of these selectors to bypass maximum length constraints. This can lead to downstream vulnerabilities such as buffer overflows in system components, data truncation in databases, or denial-of-service (DoS) due to excessive resource consumption. The issue is fixed in version 13.15.22.
Affected products
- validatorjs validator.js < 13.15.22
- n/a org.webjars.npm:validator < 13.15.22
Timeline
- 2025-10-18: disclosed: Vulnerability disclosed by Karol Wrótniak
- 2025-11-05: patched: Fix merged into master branch
- 2025-11-27: advisory: CVE published