CVE-2025-12758: Unicode Variation Selectors Bypass in ‘validator’ library (isLength)  – Full Disclosure

Posted by Karol Wrótniak on Jan 29

Summary
=======
A vulnerability was discovered in the popular JavaScript library
‘validator’.
The isLength() function incorrectly handles Unicode Variation Selectors
(U+FE0E and U+FE0F). An attacker can inject thousands of these zero-width
characters into a string, causing the library to report a much smaller
perceived length than the actual byte size. This leads to validation
bypasses,
potential database truncation, and Denial of…
 – Read More  – Full Disclosure