CVE-2025-12758

Nov. 27, 2025, 5:16 a.m.

7.7
High

Description

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Product(s) Impacted

Vendor Product Versions
Validator
  • Validator
  • <13.15.22

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-792
Incomplete Filtering of One or More Instances of Special Elements
The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a validator validator <13.15.22 / / / / / / /

References

https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
https://github.com/validatorjs/validator.js/pull/2616
https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476

Tags

report@snyk.io
2025-11-27
CVE-2025-12758
CWE-792

CVSS Score

7.7 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
  • Exploit Maturity: PROOF_OF_CONCEPT

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Nov. 27, 2025, 5:16 a.m.
Last Modified: Nov. 27, 2025, 5:16 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

report@snyk.io

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.