Skip to content

isISO8601 strict mode never validates week dates #2859

Description

@uhop

Describe the bug

With strict: true, isValidDate extracts month and day with

const match = str.match(/(\d{4})-?(\d{0,2})-?(\d*)/).map(Number);

For a week date such as 2021-W53-1 the W is not a digit, so (\d{0,2}) and
(\d*) both match the empty string. Number('') is 0, so the
if (month && day) guard at line 31 is false and the function returns true
without performing any check.

The effect is that strict: true never validates a week date at all. The
53rd week is accepted in years that only have 52 ISO weeks, and no week date
can ever be rejected by strict mode.

Examples

const validator = require('validator'); // 13.15.35

// 2019 and 2021 have 52 ISO weeks, so W53 does not exist in either
validator.isISO8601('2019-W53-1', { strict: true }); // true, expected false
validator.isISO8601('2021-W53-1', { strict: true }); // true, expected false

// 2015 and 2020 genuinely have 53 ISO weeks, so these are correct by accident
validator.isISO8601('2015-W53-1', { strict: true }); // true
validator.isISO8601('2020-W53-1', { strict: true }); // true

Every one of those returns true through the same fall-through path, so the
two correct answers are not evidence of a working check.

Reproductions

The Examples block above runs as-is on Node after
npm install validator@13.15.35; no harness or scaffolding needed.

Additional context

Related to the rewrite proposed in #2564, but reported separately because the
underlying behavior is that strict mode silently skips week dates rather than
mis-validating them.

Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions