CVE-2025-12758: Buffer Overflow
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/validatorto a version that resolves this vulnerability.Fixed in 13.15.22 - Upgrade
Upgrade
package validatorto a version that resolves this vulnerability.Fixed in 13.15.22
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12758?
CVE-2025-12758 is classified as a moderate severity vulnerability due to insufficient filtering of Unicode variation selectors.
How do I fix CVE-2025-12758?
To fix CVE-2025-12758, upgrade the validator package to version 13.15.22 or later.
What vulnerabilities does CVE-2025-12758 address?
CVE-2025-12758 addresses incomplete filtering of special elements in the isLength() function of the validator package.
Which versions of the validator package are affected by CVE-2025-12758?
Versions of the validator package prior to 13.15.22 are affected by CVE-2025-12758.
What impact does CVE-2025-12758 have on applications?
CVE-2025-12758 may lead to improper string length checking in applications, potentially causing security issues.