{"action":"Upgrade validator to 13.15.20 or later.","affected":[{"fixed":"13.15.20","introduced":"0"}],"component":"validator","cve_ids":["CVE-2025-56200"],"ecosystem":"npm","epss":0.00324,"exploited":false,"fixed_versions":["13.15.20"],"ghsa_id":"GHSA-9965-vmph-33xx","id":"tcs_01M5KFFAC5QP3W38R1K4D4EWZ3","modified_at":"2026-09-10T03:50:28.187015105Z","published_at":"2025-09-30T18:30:25Z","references":["https://osv.dev/vulnerability/GHSA-9965-vmph-33xx","https://nvd.nist.gov/vuln/detail/CVE-2025-56200","https://github.com/validatorjs/validator.js/issues/2600","https://github.com/validatorjs/validator.js/pull/2608","https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809","https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js","https://github.com/validatorjs/validator.js/releases/tag/13.15.20","http://validatorjs.com"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-9965-vmph-33xx","url":"https://osv.dev/vulnerability/GHSA-9965-vmph-33xx"}],"summary":"validator.js has a URL validation bypass vulnerability in its isURL function"}