GHSA-xx4c-jj58-r7x6
Inefficient Regular Expression Complexity in Validator.js
GHSA-xx4c-jj58-r7x6 is a medium vulnerability (CVSS 5.3) in validator, published November 19, 2021. No source lists public exploit code. Fixed in validator 13.7.0.
- Severity
- 5.3 MediumCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
13.7.0validator +2 more
Description
Impact
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
Patches
The problem has been patched in validator 13.7.0
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
validatornpm | 11.1.0 up to 13.7.0 | 13.7.0 |
validatorRoot:npm | before 13.7.0-aikido.1 | 13.7.0-aikido.1 |
@rootio/validatorRoot:npm | before 13.7.0-root.io.1 | 13.7.0-root.io.1 |
What each source reports
GitHub Advisories Score used
Inefficient Regular Expression Complexity in Validator.js
Impact
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
Patches
The problem has been patched in validator 13.7.0
- Record
GHSA-xx4c-jj58-r7x6- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
Inefficient Regular Expression Complexity in Validator.js
Impact
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
Patches
The problem has been patched in validator 13.7.0
- Record
GHSA-xx4c-jj58-r7x6- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-xx4c-jj58-r7x6No score
GHSA-xx4c-jj58-r7x6 in validator - Patched by Root
Root has patched GHSA-xx4c-jj58-r7x6 in the validator package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-xx4c-jj58-r7x6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/validatorjs/validator.js/security/advisories/GHSA-xx4c-jj58-r7x6
nvd.nist.gov/vuln/detail/CVE-2021-3765
huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9