From f266f8af5f71790ba7b20c5fe68d8a59b2cab148 Mon Sep 17 00:00:00 2001
From: Alexander Kireev <ak.chatman.media@gmail.com>
Date: Fri, 19 Jun 2026 02:15:13 +0700
Subject: [PATCH] fix(isMongoId): reject 0x-prefixed strings

---
 src/lib/isMongoId.js    | 4 ++--
 test/validators.test.js | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/lib/isMongoId.js b/src/lib/isMongoId.js
index b1a3baa8b..77ba375fc 100644
--- a/src/lib/isMongoId.js
+++ b/src/lib/isMongoId.js
@@ -1,8 +1,8 @@
 import assertString from './util/assertString';
 
-import isHexadecimal from './isHexadecimal';
+const mongoId = /^[0-9a-f]{24}$/i;
 
 export default function isMongoId(str) {
   assertString(str);
-  return isHexadecimal(str) && str.length === 24;
+  return mongoId.test(str);
 }
diff --git a/test/validators.test.js b/test/validators.test.js
index 7d9d12690..9ca73bc61 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -7525,6 +7525,8 @@ describe('Validators', () => {
         '507f1f77bcf86cd79943901z',
         '',
         '507f1f77bcf86cd799439011 ',
+        '0xaaaaaaaaaaaaaaaaaaaaaa',
+        '0Xaaaaaaaaaaaaaaaaaaaaaa',
       ],
     });
   });