express-validator is an active and widely used Express.js middleware library that provides a comprehensive suite of tools for validating and sanitizing request data. Currently at stable version 7.3.2, the library integrates directly with `validator.js`, offering a fluent API for defining validation chains for fields in the request body, query parameters, headers, or cookies. It typically releases patch and minor versions regularly, with major versions occurring less frequently (v7.0.0 was the first major update in almost four years). Key differentiators include its tight integration with Express's middleware system, robust error handling with `validationResult`, and extensive support for custom validators and sanitizers, making it a powerful solution for robust input validation in Node.js applications.
npm install express-validatorVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates setting up an Express endpoint that uses `express-validator` to validate and sanitize user registration input. It checks for a non-empty username, a valid email format, and a minimum password length, returning appropriate error responses if validation fails.
Upgrade your Node.js environment to version 14 or newer. Consult your hosting provider or `nvm` for managing Node.js versions.
Update all imports to use the unified `import { ... } from 'express-validator';` syntax and replace removed sanitization-only middlewares with validation chains that include sanitizers (e.g., `body('field').trim().escape()`).Upgrade to `express-validator` v7.2.1 or higher to ensure non-primitive replacement values are correctly cloned, preventing object reference issues. If upgrading is not possible, manually clone objects/arrays before passing them to these methods.
If your application relies on `isObject()` allowing arrays or `null`, explicitly set `options.strict: false` in your `isObject()` validator chain (e.g., `body('myField').isObject({ strict: false })`).Review the migration guide from v6 to v7 on the official documentation for detailed changes to error structures and `oneOf()` usage. Adjust error handling logic and `oneOf()` calls accordingly.
Ensure you are using ES module import syntax for `express-validator`'s named exports: `import { check, validationResult } from 'express-validator';`. If using CommonJS, use `const { check, validationResult } = require('express-validator');`.After your validation middleware, ensure your route handler checks for errors: `const errors = validationResult(req); if (!errors.isEmpty()) { return res.status(400).json({ errors: errors.array() }); }`. Also ensure you return from the error handling block to prevent the handler from executing with invalid data.In ES module contexts, use `import` statements instead of `require()`: `import { body, validationResult } from 'express-validator';`.Ensure the validation chain is correctly structured. For a single chain, pass it directly: `app.post('/route', body('field').isEmail(), (req, res) => { /* ... */ });`. If multiple chains, wrap them in a single array: `app.post('/route', [body('field1').notEmpty(), body('field2').isEmail()], (req, res) => { /* ... */ });`.