{"cve":"CVE-2025-12758","nvd":{"published":"2025-11-27T05:16:12.193","modified":"2026-10-19T13:10:00.110","status":"Modified","description":"Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","score":7.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-792","CWE-172"],"references":["https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e","https://github.com/validatorjs/validator.js/pull/2616","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011","https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476","http://seclists.org/fulldisclosure/2026/Jan/27"],"products":["validator_project:validator"],"source":"nvd","synced_at":"2026-10-19T22:16:02.354564667+00:00"},"epss":{"cve":"CVE-2025-12758","score":0.00517,"percentile":0.43718,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vghf-hv5q-vc2g","url":"https://osv.dev/vulnerability/GHSA-vghf-hv5q-vc2g","summary":"Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements","modified":"2026-09-10T03:50:58.419522514Z","packages":[{"ecosystem":"npm","name":"validator","purl":"pkg:npm/validator","ranges":["<13.15.22"],"fixed":["13.15.22"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}