SecuriTricks - CVE-2025-12758

Description

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Product(s) Impacted

Product	Versions
validator	<13.15.22

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-172

Encoding Error

The product does not properly encode or decode the data, resulting in unexpected values.

CWE-792

Incomplete Filtering of One or More Instances of Special Elements

The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.

References

https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e

https://github.com/validatorjs/validator.js/pull/2616

https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476

CVSS Score

7.7 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: LOW
Attack Requirements: NONE
Privileges Required: NONE
User Interaction: NONE
Scope:
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH
Exploit Maturity: PROOF_OF_CONCEPT

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: Nov. 27, 2025, 5:16 a.m.
Last Modified: Dec. 3, 2025, 5:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

report@snyk.io

CVE-2025-12758