Describe the bug
With strict: true, isValidDate extracts month and day with
const match = str.match(/(\d{4})-?(\d{0,2})-?(\d*)/).map(Number);
For a week date such as 2021-W53-1 the W is not a digit, so (\d{0,2}) and
(\d*) both match the empty string. Number('') is 0, so the
if (month && day) guard at line 31 is false and the function returns true
without performing any check.
The effect is that strict: true never validates a week date at all. The
53rd week is accepted in years that only have 52 ISO weeks, and no week date
can ever be rejected by strict mode.
Examples
const validator = require('validator'); // 13.15.35
// 2019 and 2021 have 52 ISO weeks, so W53 does not exist in either
validator.isISO8601('2019-W53-1', { strict: true }); // true, expected false
validator.isISO8601('2021-W53-1', { strict: true }); // true, expected false
// 2015 and 2020 genuinely have 53 ISO weeks, so these are correct by accident
validator.isISO8601('2015-W53-1', { strict: true }); // true
validator.isISO8601('2020-W53-1', { strict: true }); // true
Every one of those returns true through the same fall-through path, so the
two correct answers are not evidence of a working check.
Reproductions
The Examples block above runs as-is on Node after
npm install validator@13.15.35; no harness or scaffolding needed.
Additional context
Related to the rewrite proposed in #2564, but reported separately because the
underlying behavior is that strict mode silently skips week dates rather than
mis-validating them.
Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux
Describe the bug
With
strict: true,isValidDateextracts month and day withFor a week date such as
2021-W53-1theWis not a digit, so(\d{0,2})and(\d*)both match the empty string.Number('')is0, so theif (month && day)guard at line 31 is false and the function returnstruewithout performing any check.
The effect is that
strict: truenever validates a week date at all. The53rd week is accepted in years that only have 52 ISO weeks, and no week date
can ever be rejected by strict mode.
Examples
Every one of those returns
truethrough the same fall-through path, so thetwo correct answers are not evidence of a working check.
Reproductions
The Examples block above runs as-is on Node after
npm install validator@13.15.35; no harness or scaffolding needed.Additional context
Related to the rewrite proposed in #2564, but reported separately because the
underlying behavior is that strict mode silently skips week dates rather than
mis-validating them.
Validator.js version: 13.15.35
Node.js version: v26.7.0
OS platform: Linux