Clientside Validation 7.x-1.x, xxxx-xx-xx (development version)
-----------------------

Clientside Validation 7.x-1.51, 2026-09-09
-----------------------
- Security: Addresses arbitrary regular expression evaluation in the anonymous AJAX validation callback, which passed request supplied patterns to the PCRE engine and allowed patterns crafted to consume server processing time.
- Security: Addresses an unauthenticated path existence and access oracle in the URL validation callback, which resolved arbitrary request supplied paths through the menu router without a token.
- Security: Addresses unauthenticated invocation of arbitrary Field Validation rules through the AJAX validation callback, which ran a request named rule against a request supplied value with no confirmation that the form had offered that rule.
- Security: Addresses a CAPTCHA bypass in the anonymous AJAX validation callback, whose signed token was not bound to the CAPTCHA session being answered and which applied no attempt limit, allowing unlimited answer guessing against arbitrary sessions.
