From b3516be16521c3c4c6c066fb044ae703baeb3a35 Mon Sep 17 00:00:00 2001
From: Minh Le <ducminhldm@gmail.com>
Date: Tue, 16 Jun 2026 09:15:13 +0700
Subject: [PATCH] fix(isISO6346): anchor regex alternation and remove stray
 comma

The isISO6346 pattern had an un-grouped alternation:

  /^[A-Z]{3}(U[0-9]{7})|([J,Z][0-9]{6,7})$/

Because | has the lowest precedence and the two branches were not
wrapped in a group, the regex parsed as:

  (^[A-Z]{3}(U[0-9]{7}))  OR  (([J,Z][0-9]{6,7})$)

The first branch was anchored only at the start and the second only at
the end, so strings with trailing garbage after a valid prefix, or
leading garbage before a valid suffix, passed validation. The character
class [J,Z] also matched a literal comma, which is never valid in an
ISO 6346 category identifier.

Wrap the alternation in the existing group and drop the comma so the
whole string is anchored:

  /^[A-Z]{3}(U[0-9]{7}|[JZ][0-9]{6,7})$/

Add regression cases for the previous false positives.
---
 src/lib/isISO6346.js    | 2 +-
 test/validators.test.js | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/isISO6346.js b/src/lib/isISO6346.js
index 2c28c1123..cb6ac7b32 100644
--- a/src/lib/isISO6346.js
+++ b/src/lib/isISO6346.js
@@ -3,7 +3,7 @@ import assertString from './util/assertString';
 // https://en.wikipedia.org/wiki/ISO_6346
 // according to ISO6346 standard, checksum digit is mandatory for freight container but recommended
 // for other container types (J and Z)
-const isISO6346Str = /^[A-Z]{3}(U[0-9]{7})|([J,Z][0-9]{6,7})$/;
+const isISO6346Str = /^[A-Z]{3}(U[0-9]{7}|[JZ][0-9]{6,7})$/;
 const isDigit = /^[0-9]$/;
 
 export function isISO6346(str) {
diff --git a/test/validators.test.js b/test/validators.test.js
index a4c3d7193..49e24dbe7 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -13537,6 +13537,9 @@ describe('Validators', () => {
         'ECMJ4657496',
         'TBJA7176445',
         'AFFU5962593',
+        'ABCU1234567GARBAGE', // trailing garbage after a valid prefix
+        'GARBAGEZ123456', // leading garbage before a valid suffix
+        'XYZ,123456', // comma is not a valid category identifier
       ],
     });
   });
@@ -13562,6 +13565,9 @@ describe('Validators', () => {
         'ECMJ4657496',
         'TBJA7176445',
         'AFFU5962593',
+        'ABCU1234567GARBAGE', // trailing garbage after a valid prefix
+        'GARBAGEZ123456', // leading garbage before a valid suffix
+        'XYZ,123456', // comma is not a valid category identifier
       ],
     });
   });