diff --git a/CHANGELOG.md b/CHANGELOG.md
index 033d8339c..68956c04f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,13 @@
+# 13.15.26
+
+### Fixes, New Locales and Enhancements
+
+- [#2535](https://github.com/validatorjs/validator.js/pull/2535) `isHexColor`: add `require_hashtag` option @Numbers0689
+- [#2633](https://github.com/validatorjs/validator.js/pull/2633) `isURL`: handle possible bypass with URL-encoded content @WikiRik
+- [#2634](https://github.com/validatorjs/validator.js/pull/2634) `isIBAN`: improve `IR` locale @ds1371dani
+- **Doc fixes and others:**
+  - [#2640](https://github.com/validatorjs/validator.js/pull/2640) @WikiRik
+
 # 13.15.23
 
 ### Fixes, New Locales and Enhancements
@@ -5,7 +15,6 @@
 - **Doc fixes and others:**
   - [#2631](https://github.com/validatorjs/validator.js/pull/2631) @WikiRik
 
-
 # 13.15.22
 
 ### Fixes, New Locales and Enhancements
diff --git a/README.md b/README.md
index 985cb9ec9..c991f9cbd 100644
--- a/README.md
+++ b/README.md
@@ -173,7 +173,7 @@ Validator                               | Description
 **isVariableWidth(str)**                | check if the string contains a mixture of full and half-width chars.
 **isVAT(str, countryCode)**             | check if the string is a [valid VAT number][VAT Number] if validation is available for the given country code matching [ISO 3166-1 alpha-2][ISO 3166-1 alpha-2]. <br/><br/>`countryCode` is one of `['AL', 'AR', 'AT', 'AU', 'BE', 'BG', 'BO', 'BR', 'BY', 'CA', 'CH', 'CL', 'CO', 'CR', 'CY', 'CZ', 'DE', 'DK', 'DO', 'EC', 'EE', 'EL', 'ES', 'FI', 'FR', 'GB', 'GT', 'HN', 'HR', 'HU', 'ID', 'IE', 'IL', 'IN', 'IS', 'IT', 'KZ', 'LT', 'LU', 'LV', 'MK', 'MT', 'MX', 'NG', 'NI', 'NL', 'NO', 'NZ', 'PA', 'PE', 'PH', 'PL', 'PT', 'PY', 'RO', 'RS', 'RU', 'SA', 'SE', 'SI', 'SK', 'SM', 'SV', 'TR', 'UA', 'UY', 'UZ', 'VE']`.
 **isWhitelisted(str, chars)**           | check if the string consists only of characters that appear in the whitelist `chars`.
-**matches(str, pattern [, modifiers])** | check if the string matches the pattern.<br/><br/>Either `matches('foo', /foo/i)` or `matches('foo', 'foo', 'i')`.
+**matches(str, pattern [, modifiers])** | check if the string matches the pattern.<br/><br/>Either `matches('foo', /foo/i)` or `matches('foo', 'foo', 'i')`.<br/>**Note:** The pattern is not checked for possible ReDoS attacks. We do not recommend that the user can provide their own pattern.
 
 ## Sanitizers
 
diff --git a/package.json b/package.json
index 9474766f2..70adbbca3 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "validator",
   "description": "String validation and sanitization",
-  "version": "13.15.23",
+  "version": "13.15.26",
   "sideEffects": false,
   "homepage": "https://github.com/validatorjs/validator.js",
   "files": [
diff --git a/src/index.js b/src/index.js
index ccbcc4188..b813c6078 100644
--- a/src/index.js
+++ b/src/index.js
@@ -130,7 +130,7 @@ import isStrongPassword from './lib/isStrongPassword';
 
 import isVAT from './lib/isVAT';
 
-const version = '13.15.23';
+const version = '13.15.26';
 
 const validator = {
   version,