npm / validator
validator
What changed in validator 13, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 breaking3 security5 new APIs and options5 behavior and defaults7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initvalidator 1321 changes
Breaking changes 1
Restricts accepted characters to the valid slug charset.
Security 3
Handles a possible bypass involving URL-encoded content.
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
validator.js has a URL validation bypass vulnerability in its isURL function
New APIs and options 5
Adds the fr-DJ locale for mobile phone validation.
Adds the MC locale for postal code validation.
Adds the require_hashtag option to isHexColor.
Adds Indic locales ta-IN, te-IN, kn-IN, ml-IN, gu-IN, pa-IN, and or-IN.
Adds the ar-QA locale for mobile phone validation.
Behavior and default changes 5
Adds support for Kosovo, so XK is recognized as a valid ISO 3166-1 alpha-2 country code.
Adds support for Kosovo, so XXK is recognized as a valid ISO 3166-1 alpha-3 country code.
Allows any valid JSON value to pass validation, not just JSON objects or arrays.
The pt-BR locale now supports alphanumeric CNPJ formats and formatted CPF values.
Adds Indic locales ta-IN, te-IN, kn-IN, ml-IN, gu-IN, pa-IN, and or-IN.
Fixes and other changes 7
Ignores non-object options, avoiding unexpected handling when options are not objects.
Improves passport number validation for the MX locale.
Improves validation for the IR locale.
Improves handling of Unicode variation selectors.
Fixes a regression when validating hostnames with ports.
Improves the padding regex used for Base64 validation.
Improves VAT validation for the FR locale.