From de8e514d1ffa60e3492b582b534010d63600bdbc Mon Sep 17 00:00:00 2001
From: Alexander Kireev <ak.chatman.media@gmail.com>
Date: Tue, 30 Jun 2026 04:10:07 +0700
Subject: [PATCH] fix(isPassportNumber): anchor MZ and PH alternations

The Mozambique and Philippines patterns put the alternation outside the
anchors, so ^ bound only to the first branch and $ only to the last.
That let arbitrary leading/trailing characters slip through, e.g.
isPassportNumber('AB0808212XXXX', 'MZ') and
isPassportNumber('X123456ZZZ', 'PH') returned true. Wrapping each
alternation in a group fixes it, matching how CA/CN/EE are already
written. Added the junk-padded cases to the test fixtures.
---
 src/lib/isPassportNumber.js | 4 ++--
 test/validators.test.js     | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/lib/isPassportNumber.js b/src/lib/isPassportNumber.js
index aa0724cd7..f8dc3406a 100644
--- a/src/lib/isPassportNumber.js
+++ b/src/lib/isPassportNumber.js
@@ -48,12 +48,12 @@ const passportRegexByCountryCode = {
   LV: /^[A-Z0-9]{2}\d{7}$/, // LATVIA
   LY: /^[A-Z0-9]{8}$/, // LIBYA
   MT: /^\d{7}$/, // MALTA
-  MZ: /^([A-Z]{2}\d{7})|(\d{2}[A-Z]{2}\d{5})$/, // MOZAMBIQUE
+  MZ: /^([A-Z]{2}\d{7}|\d{2}[A-Z]{2}\d{5})$/, // MOZAMBIQUE
   MY: /^[AHK]\d{8}$/, // MALAYSIA
   MX: /^[A-Z]\d{8}$/, // MEXICO
   NL: /^[A-Z]{2}[A-Z0-9]{6}\d$/, // NETHERLANDS
   NZ: /^([Ll]([Aa]|[Dd]|[Ff]|[Hh])|[Ee]([Aa]|[Pp])|[Nn])\d{6}$/, // NEW ZEALAND
-  PH: /^([A-Z](\d{6}|\d{7}[A-Z]))|([A-Z]{2}(\d{6}|\d{7}))$/, // PHILIPPINES
+  PH: /^([A-Z](\d{6}|\d{7}[A-Z])|[A-Z]{2}(\d{6}|\d{7}))$/, // PHILIPPINES
   PK: /^[A-Z]{2}\d{7}$/, // PAKISTAN
   PL: /^[A-Z]{2}\d{7}$/, // POLAND
   PT: /^[A-Z]\d{6}$/, // PORTUGAL
diff --git a/test/validators.test.js b/test/validators.test.js
index 9c867efae..8ae5ed9e8 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -3786,6 +3786,8 @@ describe('Validators', () => {
         '1AB011241',
         '1AB01121',
         'ABAB01121',
+        'AB0808212XXXX',
+        'ZZZZ08AB12123',
       ],
     });
     test({
@@ -3855,6 +3857,8 @@ describe('Validators', () => {
         'XY12345',
         'X12345Z',
         'XY12345Z',
+        'X123456ZZZ',
+        'ZZZXY123456',
       ],
     });