diff --git a/AUTHORS.rst b/AUTHORS.rst
index 02678948..cabe5ad9 100644
--- a/AUTHORS.rst
+++ b/AUTHORS.rst
@@ -92,3 +92,4 @@ Contributors (chronological)
 - Kim Gustyr `@khvn26 <https://github.com/khvn26>`_
 - Bryce Drennan `@brycedrennan <https://github.com/brycedrennan>`_
 - Cristi Scoarta `@cristi23 <https://github.com/cristi23>`_
+- Nathan `@nbanmp <https://github.com/nbanmp>`_
diff --git a/src/marshmallow/validate.py b/src/marshmallow/validate.py
index 02e09024..fdc51aef 100644
--- a/src/marshmallow/validate.py
+++ b/src/marshmallow/validate.py
@@ -65,7 +65,7 @@ class URL(Validator):
                 r'\[?[A-F0-9]*:[A-F0-9:]+\]?)',  # ...or ipv6
                 r'(?::\d+)?',  # optional port
                 r')?' if relative else r'',  # host is optional, allow for relative URLs
-                r'(?:/?|[/?]\S+)$',
+                r'(?:/?|[/?]\S+)\Z',
             )), re.IGNORECASE)
 
         def __call__(self, relative, require_tld):
@@ -120,18 +120,18 @@ class Email(Validator):
     """
 
     USER_REGEX = re.compile(
-        r"(^[-!#$%&'*+/=?^`{}|~\w]+(\.[-!#$%&'*+/=?^`{}|~\w]+)*$"  # dot-atom
+        r"(^[-!#$%&'*+/=?^`{}|~\w]+(\.[-!#$%&'*+/=?^`{}|~\w]+)*\Z"  # dot-atom
         # quoted-string
         r'|^"([\001-\010\013\014\016-\037!#-\[\]-\177]'
-        r'|\\[\001-\011\013\014\016-\177])*"$)', re.IGNORECASE | re.UNICODE)
+        r'|\\[\001-\011\013\014\016-\177])*"\Z)', re.IGNORECASE | re.UNICODE)
 
     DOMAIN_REGEX = re.compile(
         # domain
         r'(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+'
-        r'(?:[A-Z]{2,6}|[A-Z0-9-]{2,})$'
+        r'(?:[A-Z]{2,6}|[A-Z0-9-]{2,})\Z'
         # literal form, ipv4 address (SMTP 4.1.3)
         r'|^\[(25[0-5]|2[0-4]\d|[0-1]?\d?\d)'
-        r'(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}\]$', re.IGNORECASE | re.UNICODE)
+        r'(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}\]\Z', re.IGNORECASE | re.UNICODE)
 
     DOMAIN_WHITELIST = ('localhost',)
 

Incorrect Email Validation
https://github.com/marshmallow-code/marshmallow/blob/fbe22eb47db5df64b2c4133f9a5cb6c6920e8dd2/src/marshmallow/validate.py#L136-L151

The email validation regex will match `email@domain.com\n`, `email\n@domain.com`, and `email\n@domain.com\n`.

The issue is that `$` is used to match until the end of a string. Instead, `\Z` should be used. - https://stackoverflow.com/a/48730645

It is possible that other validators might suffer from the same bug, so it would be good if other regexes were also checked.

It is unclear, but this may lead to a security vulnerability in some projects that use marshmallow (depending on how the validator is used), so a quick fix here might be helpful. In my quick look around I didn't notice anything critical, however, so I figured it would be fine to open this issue.
diff --git a/tests/test_validate.py b/tests/test_validate.py
index cafd1e98..109319b7 100644
--- a/tests/test_validate.py
+++ b/tests/test_validate.py
@@ -41,6 +41,7 @@ def test_url_absolute_valid(valid_url):
     'http:/example.org',
     'foo://example.org',
     '../icons/logo.gif',
+    'https://example.org\n',
     'abc',
     '..',
     '/',
@@ -71,6 +72,7 @@ def test_url_relative_valid(valid_url):
     'suppliers.html',
     '../icons/logo.gif',
     'icons/logo.gif',
+    'http://example.org\n',
     '../.../g',
     '...',
     '\\',
@@ -98,6 +100,7 @@ def test_url_dont_require_tld_valid(valid_url):
 
 @pytest.mark.parametrize('invalid_url', [
     'http//example',
+    'http://example\n',
     'http://.example.org',
     'http:///foo/bar',
     'http:// /foo/bar',
@@ -165,6 +168,8 @@ def test_email_valid(valid_email):
     assert validator(valid_email) == valid_email
 
 @pytest.mark.parametrize('invalid_email', [
+    'niceandsimple\n@example.com',
+    'NiCeAnDsImPlE@eXaMpLe.CoM\n',
     'a"b(c)d,e:f;g<h>i[j\\k]l@example.com',
     'just"not"right@example.com',
     'this is"not\allowed@example.com',

pip install -e .[dev]
parse_log_pytest
pytest
pytest
apt-get update apt-get install -y gcc
3.7
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///croot/attrs_1668696182826/work
cachetools==5.5.2
certifi @ file:///croot/certifi_1671487769961/work/certifi
chardet==5.2.0
colorama==0.4.6
distlib==0.3.9
entrypoints==0.3
filelock==3.12.2
flake8==3.7.4
flit_core @ file:///opt/conda/conda-bld/flit-core_1644941570762/work/source/flit_core
importlib-metadata==6.7.0
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
-e git+https://github.com/marshmallow-code/marshmallow.git@7015fc4333a2f32cd58c3465296e834acd4496ff#egg=marshmallow
mccabe==0.6.1
packaging==24.0
platformdirs==4.0.0
pluggy==1.2.0
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pycodestyle==2.5.0
pyflakes==2.1.1
pyproject-api==1.5.3
pytest==7.1.2
python-dateutil==2.9.0.post0
pytz==2025.2
simplejson==3.20.1
six==1.17.0
tomli @ file:///opt/conda/conda-bld/tomli_1657175507142/work
tox==4.8.0
typing_extensions==4.7.1
virtualenv==20.26.6
zipp @ file:///croot/zipp_1672387121353/work

name: marshmallow
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=22.1.0=py37h06a4308_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - flit-core=3.6.0=pyhd3eb1b0_0
  - importlib_metadata=4.11.3=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - py=1.11.0=pyhd3eb1b0_0
  - pytest=7.1.2=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tomli=2.0.1=py37h06a4308_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.11.0=py37h06a4308_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - cachetools==5.5.2
      - chardet==5.2.0
      - colorama==0.4.6
      - distlib==0.3.9
      - entrypoints==0.3
      - filelock==3.12.2
      - flake8==3.7.4
      - importlib-metadata==6.7.0
      - mccabe==0.6.1
      - packaging==24.0
      - platformdirs==4.0.0
      - pluggy==1.2.0
      - pycodestyle==2.5.0
      - pyflakes==2.1.1
      - pyproject-api==1.5.3
      - python-dateutil==2.9.0.post0
      - pytz==2025.2
      - simplejson==3.20.1
      - six==1.17.0
      - tox==4.8.0
      - typing-extensions==4.7.1
      - virtualenv==20.26.6
prefix: /opt/conda/envs/marshmallow

tests/test_validate.py::test_url_absolute_invalid[https://example.org\n] tests/test_validate.py::test_url_relative_invalid[http://example.org\n] tests/test_validate.py::test_url_dont_require_tld_invalid[http://example\n] tests/test_validate.py::test_email_invalid[niceandsimple\n@example.com] tests/test_validate.py::test_email_invalid[NiCeAnDsImPlE@eXaMpLe.CoM\n]
tests/test_validate.py::test_url_absolute_valid[http://example.org] tests/test_validate.py::test_url_absolute_valid[https://example.org] tests/test_validate.py::test_url_absolute_valid[ftp://example.org] tests/test_validate.py::test_url_absolute_valid[ftps://example.org] tests/test_validate.py::test_url_absolute_valid[http://example.co.jp] tests/test_validate.py::test_url_absolute_valid[http://www.example.com/a%C2%B1b] tests/test_validate.py::test_url_absolute_valid[http://www.example.com/~username/] tests/test_validate.py::test_url_absolute_valid[http://info.example.com/?fred] tests/test_validate.py::test_url_absolute_valid[http://xn--mgbh0fb.xn--kgbechtv/] tests/test_validate.py::test_url_absolute_valid[http://example.com/blue/red%3Fand+green] tests/test_validate.py::test_url_absolute_valid[http://www.example.com/?array%5Bkey%5D=value] tests/test_validate.py::test_url_absolute_valid[http://xn--rsum-bpad.example.org/] tests/test_validate.py::test_url_absolute_valid[http://123.45.67.8/] tests/test_validate.py::test_url_absolute_valid[http://2001:db8::ff00:42:8329] tests/test_validate.py::test_url_absolute_valid[http://www.example.com:8000/foo] tests/test_validate.py::test_url_absolute_valid[http://user@example.com] tests/test_validate.py::test_url_absolute_valid[http://user:pass@example.com] tests/test_validate.py::test_url_absolute_invalid[http:///example.com/] tests/test_validate.py::test_url_absolute_invalid[https:///example.com/] tests/test_validate.py::test_url_absolute_invalid[https://example.org\\] tests/test_validate.py::test_url_absolute_invalid[ftp:///example.com/] tests/test_validate.py::test_url_absolute_invalid[ftps:///example.com/] tests/test_validate.py::test_url_absolute_invalid[http//example.org] tests/test_validate.py::test_url_absolute_invalid[http:///] tests/test_validate.py::test_url_absolute_invalid[http:/example.org] tests/test_validate.py::test_url_absolute_invalid[foo://example.org] tests/test_validate.py::test_url_absolute_invalid[../icons/logo.gif] tests/test_validate.py::test_url_absolute_invalid[abc] tests/test_validate.py::test_url_absolute_invalid[..] tests/test_validate.py::test_url_absolute_invalid[/] tests/test_validate.py::test_url_absolute_invalid[ tests/test_validate.py::test_url_absolute_invalid[] tests/test_validate.py::test_url_absolute_invalid[None] tests/test_validate.py::test_url_relative_valid[http://example.org] tests/test_validate.py::test_url_relative_valid[http://123.45.67.8/] tests/test_validate.py::test_url_relative_valid[http://example.com/foo/bar/../baz] tests/test_validate.py::test_url_relative_valid[https://example.com/../icons/logo.gif] tests/test_validate.py::test_url_relative_valid[http://example.com/./icons/logo.gif] tests/test_validate.py::test_url_relative_valid[ftp://example.com/../../../../g] tests/test_validate.py::test_url_relative_valid[http://example.com/g?y/./x] tests/test_validate.py::test_url_relative_invalid[http//example.org] tests/test_validate.py::test_url_relative_invalid[suppliers.html] tests/test_validate.py::test_url_relative_invalid[../icons/logo.gif] tests/test_validate.py::test_url_relative_invalid[icons/logo.gif] tests/test_validate.py::test_url_relative_invalid[../.../g] tests/test_validate.py::test_url_relative_invalid[...] tests/test_validate.py::test_url_relative_invalid[\\] tests/test_validate.py::test_url_relative_invalid[ tests/test_validate.py::test_url_relative_invalid[] tests/test_validate.py::test_url_relative_invalid[None] tests/test_validate.py::test_url_dont_require_tld_valid[http://example.org] tests/test_validate.py::test_url_dont_require_tld_valid[http://123.45.67.8/] tests/test_validate.py::test_url_dont_require_tld_valid[http://example] tests/test_validate.py::test_url_dont_require_tld_valid[http://example.] tests/test_validate.py::test_url_dont_require_tld_valid[http://example:80] tests/test_validate.py::test_url_dont_require_tld_valid[http://user.name:pass.word@example] tests/test_validate.py::test_url_dont_require_tld_valid[http://example/foo/bar] tests/test_validate.py::test_url_dont_require_tld_invalid[http//example] tests/test_validate.py::test_url_dont_require_tld_invalid[http://.example.org] tests/test_validate.py::test_url_dont_require_tld_invalid[http:///foo/bar] tests/test_validate.py::test_url_dont_require_tld_invalid[http:// tests/test_validate.py::test_url_dont_require_tld_invalid[] tests/test_validate.py::test_url_dont_require_tld_invalid[None] tests/test_validate.py::test_url_custom_scheme tests/test_validate.py::test_url_relative_and_custom_schemes tests/test_validate.py::test_url_custom_message tests/test_validate.py::test_url_repr tests/test_validate.py::test_email_valid[niceandsimple@example.com] tests/test_validate.py::test_email_valid[NiCeAnDsImPlE@eXaMpLe.CoM] tests/test_validate.py::test_email_valid[very.common@example.com] tests/test_validate.py::test_email_valid[a.little.lengthy.but.fine@a.iana-servers.net] tests/test_validate.py::test_email_valid[disposable.style.email.with+symbol@example.com] tests/test_validate.py::test_email_valid["very.unusual.@.unusual.com"@example.com] tests/test_validate.py::test_email_valid[!#$%&'*+-/=?^_`{}|~@example.org] tests/test_validate.py::test_email_valid[niceandsimple@[64.233.160.0]] tests/test_validate.py::test_email_valid[niceandsimple@localhost] tests/test_validate.py::test_email_valid[jos\xe9@blah.com] tests/test_validate.py::test_email_valid[\u03b4\u03bf\u03ba.\u03b9\u03bc\u03ae@\u03c0\u03b1\u03c1\u03ac\u03b4\u03b5\u03b9\u03b3\u03bc\u03b1.\u03b4\u03bf\u03ba\u03b9\u03bc\u03ae] tests/test_validate.py::test_email_invalid[a"b(c)d,e:f;g<h>i[j\\k]l@example.com] tests/test_validate.py::test_email_invalid[just"not"right@example.com] tests/test_validate.py::test_email_invalid[this tests/test_validate.py::test_email_invalid[this\\ tests/test_validate.py::test_email_invalid["much.more tests/test_validate.py::test_email_invalid["very.(),:;<>[]".VERY."very@\\ tests/test_validate.py::test_email_invalid[" tests/test_validate.py::test_email_invalid[user@example] tests/test_validate.py::test_email_invalid[@nouser.com] tests/test_validate.py::test_email_invalid[example.com] tests/test_validate.py::test_email_invalid[user] tests/test_validate.py::test_email_invalid[] tests/test_validate.py::test_email_invalid[None] tests/test_validate.py::test_email_custom_message tests/test_validate.py::test_email_repr tests/test_validate.py::test_range_min tests/test_validate.py::test_range_max tests/test_validate.py::test_range_custom_message tests/test_validate.py::test_range_repr tests/test_validate.py::test_length_min tests/test_validate.py::test_length_max tests/test_validate.py::test_length_equal tests/test_validate.py::test_length_custom_message tests/test_validate.py::test_length_repr tests/test_validate.py::test_equal tests/test_validate.py::test_equal_custom_message tests/test_validate.py::test_equal_repr tests/test_validate.py::test_regexp_str tests/test_validate.py::test_regexp_compile tests/test_validate.py::test_regexp_custom_message tests/test_validate.py::test_regexp_repr tests/test_validate.py::test_predicate tests/test_validate.py::test_predicate_custom_message tests/test_validate.py::test_predicate_repr tests/test_validate.py::test_noneof tests/test_validate.py::test_noneof_custom_message tests/test_validate.py::test_noneof_repr tests/test_validate.py::test_oneof tests/test_validate.py::test_oneof_options tests/test_validate.py::test_oneof_text tests/test_validate.py::test_oneof_custom_message tests/test_validate.py::test_oneof_repr tests/test_validate.py::test_containsonly_in_list tests/test_validate.py::test_contains_only_unhashable_types tests/test_validate.py::test_containsonly_in_tuple tests/test_validate.py::test_contains_only_in_string tests/test_validate.py::test_contains_only_invalid tests/test_validate.py::test_containsonly_custom_message tests/test_validate.py::test_containsonly_repr
src/marshmallow/validate.py AUTHORS.rst
src/marshmallow/validate.py AUTHORS.rst