Is CVE-2025-12758 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-12758 being exploited in the wild.

How severe is CVE-2025-12758?

High severity, with a CVSS score of 7.5, published 27 November 2025.

Which products and versions are affected?

validator (npm) SEMVER:introduced=0,fixed=13.15.22.

Is there a fix for CVE-2025-12758?

Yes. validator (npm): upgrade to 13.15.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-12758 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-12758?

Check whether you run validator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12758: validator.js improper length calculation in isLength function

CVE-2025-12758 · Severity: high · CVSS 7.5 · Published 2025-11-27

The validator.js library, a popular tool used by developers to check and clean user-provided text, contains a flaw in how it calculates the length of certain characters. An attacker can bypass character limit restrictions by including specific hidden Unicode characters in their input. This could allow them to submit unexpectedly large amounts of data, potentially crashing the application, causing data to be cut off in databases, or creating other system instabilities.

Technologies: validator (npm). Vendors: npm.

Quick answers

Is CVE-2025-12758 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-12758 being exploited in the wild.
How severe is CVE-2025-12758?: High severity, with a CVSS score of 7.5, published 27 November 2025.
Which products and versions are affected?: validator (npm) SEMVER:introduced=0,fixed=13.15.22.
Is there a fix for CVE-2025-12758?: Yes. validator (npm): upgrade to 13.15.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12758 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-12758?: Check whether you run validator (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

validator (npm): upgrade to 13.15.22 or later
```
npm install validator@13.15.22
```

Technical details

The validator.js library's isLength() function incorrectly handles Unicode variation selectors (\uFE0F and \uFE0E). The function's logic subtracts all instances of these selectors from the total string length regardless of their position, rather than only discounting them when they follow a base character as per the Unicode standard. A remote attacker can exploit this by embedding a large number of these selectors to bypass maximum length constraints. This can lead to downstream vulnerabilities such as buffer overflows in system components, data truncation in databases, or denial-of-service (DoS) due to excessive resource consumption. The issue is fixed in version 13.15.22.

Affected products

validatorjs validator.js < 13.15.22
n/a org.webjars.npm:validator < 13.15.22

Identifiers

CVE-2025-12758
GHSA-vghf-hv5q-vc2g

Timeline

2025-10-18: disclosed: Vulnerability disclosed by Karol Wrótniak
2025-11-05: patched: Fix merged into master branch
2025-11-27: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.