CVE-2025-12758

State: Published
Severity: 8.7 High
Published: Nov 27, 2025
Updated: Aug 8, 2026
Reserved: Nov 5, 2025

Description

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P	snyk
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P	snyk

Weaknesses

CWE-792 Incomplete Filtering of One or More Instances of Special Elements
CWE-172 Encoding Error

Affected Products

Product	Versions
validatorn/a	before 13.15.22Affected
org.webjars.npm:validatorn/a	before 13.15.22Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.