NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #1653 most downloaded on npm
String validation and sanitization
Last release 6 months ago
02 Apr 2026
Release timing varies
gaps range from 2 weeks to 1.3 years
Nearly every release is documented
notes for 58 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
16 years old
218 releases · first in 2011
Fixes, New Locales and Enhancements
isISO31661Alpha2/isISO31661Alpha3: add support for Kosovo (XK / XXK) @johanpoirier-d4isHexColor: ignore non-object options @yuna0831isTaxID
isPassportNumber: improve MX locale @jesroffroukisMobilePhone: add fr-DJ locale @Kartikeya-guthubisPostalCode: add MC locale @moogblobisJSON: allow any valid JSON value to pass @relu91isSlug: restrict allowed characters to valid slug charset @ShrawakFull Changelog: 13.15.26...13.15.35
One column per quarter.
Fixes, New Locales and Enhancements
isHexColor: add require_hashtag option @Numbers0689isURL: handle possible bypass with URL-encoded content @WikiRikisIBAN: improve IR locale @ds1371daniFull Changelog: 13.15.23...13.15.26
Fixes, New Locales and Enhancements
Full Changelog: 13.15.22...13.15.23
Fixes, New Locales and Enhancements
isURL: fix regression with hostnames with ports @mbtoolsisLength: improve handling Unicode variation selectors @koral--Full Changelog: 13.15.20...13.15.22
Fixes, New Locales and Enhancements
isMobilePhone: add ar-QA locale @WardKhaddourisAlpha/isAlphanuneric: add Indic locales (ta-IN, te-IN, kn-IN, ml-IN, gu-IN, pa-IN, or-IN) @avadootharajeshisBase64: improve padding regex @KrayzeeKevisVAT: improve FR locale @iamAmerisURL: improve protocol detection. Resolves CVE-2025-56200 @theofidryFull Changelog: 13.15.15...13.15.20
Fixes, New Locales and Enhancements
isMobilePhone
el-CY locale @rezk2llpt-AO locale @renaldodevar-OM locale @tomcastroisIP: allow usage of option object @pixelbucket-devisPassportNumber: improve CA locale @evanbechtolisBase64: improve validation based on RFC4648 @aseyfpourisPostalCode: improve FR locale @Rajput-BalramisBefore: allow usage of option object @pixelbucket-devisRgbColor: allow second digit in rgba alpha value @contrololisIP: improve IPv6 regex @ShreySinha02isPostalCode: add PK locale @mateeni-devisPostalCode: improve TW locale @CrocsxisPassportNumber: improve US locale @yitzchak-schechterisUUID: add loose option @bc-misPostalCode: add BD locale @tanvirrbisLicensePlate: improve pt-PT locale @castrosuFull Changelog: 13.15.0...13.15.15
Thanks to @WikiRik for prepping the release <3
Thanks to @WikiRik for prepping the release <3
isISO31661Numeric @RobinvanderVlietisULID @arafatknisISO15924 @xDivisionByZeroxisMobilePhone
es-GT locale @ignaciosuarezquilisen-GB locale @ihmpaveluk-UA locale @arttigerky-KG locale @sadralieven-ZM locale @sonikishanen-GH locale @NanaAb-116mk-MK locale @eshward95sq-AL locale @nichoolaisBtcAddress support all address formats and testnets @madokeisIBAN improve VG regex @ST-DDTisISO4217 update currency codes @cbodtorfisIdentityCard add PK locale @Daniyal-QureshiisEmail fix blacklist_chars @keshavlingalaisInt/isFloat handle undefined and null values @Daniyal-QureshiisPostalCode add CO locale @jorgevrgsisPassportNumber export passportNumberLocales @derekparnellisRgbColor add allowSpaces option @a-h-iisUUID require valid variant field and require RFC9562 UUID in version all @broofaisURL add max_allowed_length option @pinkieskyisEmail reject starting with double quotes @code0emperorisLicensePlate add en-SG locale @Sabarinathan07normalizeEmail add yandex_convert_yandexru option @AayushGHisDate return false instead of Error in certain cases @pano9000isLength add discreteLengths option @Suven-pisDate disallow mismatching length in strictMode @sonikishanisISO6346 set check digit to 0 if remainder is 10 @joelcuyisPostalCode improve BR locale @ticmaisdevisEmail allow regexp in host_whitelist and host_blacklist @weikangchiaisIBAN improve IE/PS regex @Tarasz57Full Changelog: 13.12.0...13.15.0
Fixes, New Locales and Enhancements
isLicensePlate add Pakistani en-PK locale @anasshakilisPort fix invalid leading zeros @anasshakilisTaxID added Argentina es-AR locale @estefrareisDate timezone offset fix @tomaspanekisPassportNumber added ZA locale @GMorris-professionalisMobilePhone:
en-MW locale @SimranSiddiquiam-AM locale @AlexKrupkoisPostalAddress fix NL locale @RobinvanderVlietisISO4217 add SLE currency @urgisStrongPassword fix symbolRegex to include \ @nandavikasisVAT fixed KZ locale @MatthieuLemoineisAlpha, isAlphanumeric added eo locale @RobinvanderVlietisIBAN add Algeria DZ locale @thibault-lrisVATimprove AU locale @matthewberrymanisUUID add support for v7 @rusconisTaxID add Ukraine uk-UA locale @arttigerisDate disallow hiphen before year @Sumit-tech-joshiFull Changelog: 13.11.0...13.12.0
Fixes, New Locales and Enhancements
isIBAN add MA locale @lroudgeisCreditCard refactor @pano9000isLocale add support for more language tags @kwahomeisVAT for CU @jimmyorpheusisJWT @Prathamesh061IsFQDN test enhancements @aalekhpatel07isAlpha, isAlphanumeric for kk-KZ @BekStar7isEmail support allow_underscores @guspowerisDate enhance Date declaration compatibility across multiple environments @CiprianSisIBAN add white and blacklist options to the isIBAN validator @edilsonisEmail do not allow non-breaking space in user part @jeremy21212121isMobilePhone:
so-SO @ohersifr-CF @cheboies-CU @klaframboisepl-PL @czerwony03fr-WF @aidos42ar-SD @HussienmaFull Changelog: 13.9.0...13.11.0
@ferdousulhaque made their first contribution in #1813
13.9.0#1888 isBase32: add option for Crockford's base32 alternative @BigOsvaap
#1920 isEmail: add host_whitelist option @poor-coder
#1939 isFQDN: fix allow_numeric_tld option @BigOsvaap
#1962 isIP: refactor @UnKnoWn-Consortium
#1995 isURL: fix check for host @mortbauer
#2008 isCreditCard @brianwhaley
#2148 isStrongPassword @sandmule
#2170 isEmail: fix ignore_max_length for FQDN @sakhmedbayev
#2020 isFloat: fix comma(,) passing as float @frederike-ramin
Documentation fixes:
Code Refactors:
isAlpha, isAlphanumeric:
bn-BD @rak810si-LK @melkorCBAja-JP @starcharlesko-KR @DongkyuuuuisBIC:
XK @import-brainisIdentityCard:
hk-HK @DongkyuuuuisMobilePhone:
my-MM, @ferdousulhaquede-DE, @thomaschaafen-LS, @DevilsAutumnel-CY, @ikerasiotises-NI, @ajGingrichaz-AZ, @shaanaliyevir-IR, @ArashST79ky-KG, @arsalanfirooziar-YE, ar-EH, fa-AF, @Mustafiz04ro-MD, @mik7upar-YE, en-BS, @savannahvaithka-GE, @avkvakpt-BR, @jhcaiafa @matheusnascgomeses-HN, @ademyan05nl-AW, @adida948en-JM, @ademyan05mn-MN, @rksp25fr-BJ, @rkuma552 @rksp25mg-MG, @ShivangiRai1310en-PG, @kai2128en-AG, @jiaweilowen-AI, @elaine1129en-KN, @Eelyneeefr-CD, @coolbeatz71en-SS, @cheboidv-MV, @pano9000en-HN, @WikiRikar-KW, @Yazan-KE @WikiRikel-GR, @pano9000en-BM, @pano9000ms-MY, @pano9000ro-RO, @pano9000isLicensePlate:
sv-SE, @elmaxehu-HU, @szabolcstarnaien-NI, @NishantJSde-DE, @bennetfabiande-DE, @bennetfabianes-AR, @alvarocastroisPassportNumber:
isPostalCode:
isTaxID:
en-CA, @boonya'AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR', 'DE', 'EL', 'HU', 'IE', 'LV', 'LT', 'LU', 'MT', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'AL', 'MK', 'AU', 'BY', 'CA', 'IS', 'IN', 'ID', 'IL', 'KZ', 'NZ', 'NG', 'NO', 'PH', 'RU', 'SM', 'SA', 'RS', 'CH', 'TR', 'UA', 'UZ', 'AR', 'BO', 'BR', 'CL', 'CO', 'CR', 'EC', 'SV', 'GT', 'HN', 'MX', 'NI', 'PA', 'PY', 'PE', 'DO', 'UY', 'VE' @Dev1lDragonFull Changelog: 13.7.0...13.9.0
@jmacmahon made their first contribution in https://github.com/validatorjs/validator.js/pull/1654
13.7.0isISO4217, currency code validator @jpaya17isFQDN: add allow_wildcard option @fasenderosisRFC3339: Disallow prepended and appended strings to RFC 3339 date-time @jmacmahonIBAN export list of country codes that implement IBAN @dror-heller @fedeciisBoolean: add loose option @brybrophyisISO31661Alpha3: perf @jpaya17isDate: allow users to strictly validate dates with . as delimiter @flymansisCreditCard: fix for Union Pay cards @shreyassai123isEmail: replace all dots in GMail length validation @DasDingGehtNichtisURL: add allow_fragments and allow_query_components @cowboy-bebugisISO31661Alpha2: perf @jpaya17isMagnetURI @tux-tntrim: remove regex to prevent ReDOS attack @tux-tnisURL: higher priority to whitelist @deepanshu2506isURL: allow url with colon and no port @MatteoPierroisUUID: fix for null version argument @theteladrasisFQDN: check more special chars @MatteoPierroisURL: allow URL with an empty user @MiguelSavignanounescape: fixed bug where intermediate string contains escaped @Marcholiocontains: can check that string contains seed multiple times @MarcholioisUUID: add support for validation of v1 and v2 @theteladrasisEmail: add host_blacklist option @fedeciisAlpha, isAlphanumeric:
isPassportNumber:
isPostalCode:
LK @nimanthadilzisIdentityCard:
isMobilePhone:
de-DE @AnnaMariaJansenvi-VN @luisrivaszh-CN @laulujan @yisibles-VE @islasjuanpnl-BE @divikshrivastavaes-CU @pasagedeves-SV, @herejear-PS, @brendan-cen-BM @HackProAITdz-BT @lakshayr003en-BW, @mgndolanfr-CM @beckettnormingtonen-PK @ammad20120 @tux-tntk-TM, @Husan-Eshonquloven-GY, @mfkrausesi-LK @Madhavi96fr-PF, @herejeen-KI, @c-tannerhu-HU @danielTiringerfr-BF, en-NA @lakshayr003tg-TJ @mgnssisLicensePlate:
isVAT:
NL @zeno4everFull Changelog: https://github.com/validatorjs/validator.js/compare/13.6.1...13.7.0
Nothing published for this version
Nothing published for this version
> NOTE: 13.5.0 had a build issue and was recalled, see #1538 #1537
NOTE: 13.5.0 had a build issue and was recalled, see #1538 #1537
New features:
Fixes and Enhancements:
isISO8601: add strictSeparator @brostone51isFQDN: make more strict @CristhianMotocheisFQDN: allow_underscore option @gibson042isEmail: character blacklisting @rubiinisURL: added require_port option @yshanliisEmail: respect ignore_max_length option @evantahlerisDate: add strictMode and prevent mixed delimiters @tux-tnisAlpha: support ignore option @mum-never-proudNew and Improved locales:
isAlpha, isAlphanumeric:
isMobilePhone:
isPostalCode:
isPassportNumber:
__ <sub>this release is dedicated to @dbnandaa 🧒</sub>
isStrongPassword #1348 @door-bell
New features:
Fixes and Enhancements:
isISO8601: add strictSeparator @brostone51isFQDN: make more strict @CristhianMotocheisFQDN: allow_underscore option @gibson042isEmail: character blacklisting @rubiinisURL: added require_port option @yshanliisEmail: respect ignore_max_length option @evantahlerisDate: add strictMode and prevent mixed delimiters @tux-tnisAlpha: support ignore option @mum-never-proudNew and Improved locales:
isAlpha, isAlphanumeric:
isMobilePhone:
isPostalCode:
isPassportNumber:
<sub>— this release is dedicated to @dbnandaa 🧒</sub>
## 20/09 Release - New features: - None - Fixes and chores: - #1425 fix validation for _userinfo_ part for isURL @heanzyzabala - #1419 fix isBase32 an
New features:
Fixes and chores:
isURL @heanzyzabalaisBase32 and isBase64 to validate empty strings properly @AberDerBartisTaxId @dspinellisvalidate_length option for isURL @tomgrossmanNew and Improved locales:
Hotfix for a regex incompatibility in some browsers (#1355
See the changelog.
See the changelog.
isIMEI() validator
(#1346)isDate() validator
(#1270)isTaxID() validator
(#1336)isLatLong()
(#1340)isJSON()
(#1328)contains()
(#1334)isCreditCard()
(#1177)isCurrency()
(#1306)isFQDN() handling of certain special chars
(#1091)isSlug()
(#1338)Added isEthereumAddress() validator to validate Ethereum addresses
isEthereumAddress() validator
to validate Ethereum addresses
(#1117)isBtcAddress() validator
to validate Bitcoin addresses
(#1163)isIBAN() validator
to validate International Bank Account Numbers
(#1243)isEAN() validator
to validate International Article Numbers
(#1244)isSemVer() validator
to validate Semantic Version Numbers
(#1246)isPassportNumber() validator
(#1250)isRgbColor() validator
(#1141)isHSL() validator
(#1159)isLocale() validator
(#1072)isIP() validator
(#1211)isMACAddress() validator
(#1267)See the changelog.
See the changelog.
Added isBIC() validator for bank identification codes
isOctal() validator
(#1153)isSlug() validator
(#1096)isBIC() validator for bank identification codes
(#1071)isHash()
(#1062)isHexadecimal()
(#1147)isMACAddress()
(#1065)isLength()
(#1070)Updated isEmail() to validate display names according to RFC2822
See the changelog
See the changelog.
See the changelog.
See the changelog.
Ignore case when checking URL protocol
Added isMagnetURI() to validate magnet URIs
isMagnetURI() to validate magnet URIs
(#884)isJWT() to validate JSON web tokens
(#885)Updated isMobilePhone() to match any locale's pattern by default
Disabled domain-specific email validation
isEmail()
(#845)no_symbols option to isNumeric()
(#848)no_colons option to isMACAddress()
(#849)isURL() to reject protocol relative URLs unless a flag is set
(#860)Accept an array of locales in isMobilePhone()
Strict Gmail validation in isEmail()
Export the list of supported locales in isPostalCode()
isPostalCode()
(#830)Added an isISO31661Alpha3() validator
isISO31661Alpha3() validator
(#809)Allow floating points in isNumeric()
isNumeric()
(#810)isRFC3339() validator
(#816)isFQDN(), isURL() and isEmail()
(bb3e542)isCreditCard()
(#805)isFloat() min/max/gt/lt filters when a locale with a comma decimal is used
(2b70821)Patched a REDOS vulnerability in isDataURI
Added an option to isMobilePhone to require a country code
Added an isMimeType() validator
Fixed a bug with the isFloat validator
isFloat validator
(#752)- Locale fixes (#738, #739)
Added an isISO31661Alpha2() validator
normalizeEmail() no longer validates the email address
Fix require('validator/lib/isIS8601') calls
isURL() now requires the require_tld: false option to validate localhost
Added an isISRC() validator for ISRC
- Remove isDate()
isDate()- Disallow < and > in URLs (#613) - New locales
Added an option to require an email display name
Added support for greater or less than in isFloat()
Backslash is now escaped in escape()
Added support for IPv6 in isURL()
Fixed a regex denial of service in trim() and rtrim()
Accept Union Pay credit cards in isCreditCard()
Your coding agent can read these notes before it upgrades. Set up the MCP server →