Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) ap…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-12758 · Microsoft / collected KEV context

EUVD-2025-199795

GHSA-vghf-hv5q-vc2g

cve-program · CVE-2025-12758

• https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011
• https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
• https://github.com/validatorjs/validator.js/pull/2616

euvd · EUVD-2025-199795

• https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011
• https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
• https://github.com/validatorjs/validator.js/pull/2616

nvd · CVE-2025-12758

• https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
• https://github.com/validatorjs/validator.js/pull/2616
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011
• https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
• http://seclists.org/fulldisclosure/2026/Jan/27

osv · GHSA-vghf-hv5q-vc2g

• https://nvd.nist.gov/vuln/detail/CVE-2025-12758
• https://github.com/validatorjs/validator.js/pull/2616
• https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382
• https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e
• https://github.com/validatorjs/validator.js
• https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476
• http://seclists.org/fulldisclosure/2026/Jan/27

No related operational record is retained in the current change model.