MEDIUM6.1
GHSA-9965-vmph-33xx
validator.js has a URL validation bypass vulnerability in its isURL function
Quick fix
GHSA-9965-vmph-33xx — validator: upgrade to the fixed version with the command below.
npm install validator@13.15.20Details
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-56200[ADVISORY]
- https://github.com/validatorjs/validator.js/issues/2600[WEB]
- https://github.com/validatorjs/validator.js/pull/2608[WEB]
- https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809[WEB]
- https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666[WEB]
- https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596[WEB]
- https://github.com/validatorjs/validator.js[PACKAGE]
- https://github.com/validatorjs/validator.js/releases/tag/13.15.20[WEB]
- http://validatorjs.com[WEB]