From 23980df671cccc7cba1f10fb25e6d0e7e95bb249 Mon Sep 17 00:00:00 2001
From: WorkBuddy <workbuddy@local>
Date: Tue, 18 Aug 2026 14:25:10 +0800
Subject: [PATCH] fix(isISO6346): group alternation and drop comma from class
 so malformed strings are rejected

---
 src/lib/isISO6346.js    | 2 +-
 test/validators.test.js | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/lib/isISO6346.js b/src/lib/isISO6346.js
index 2c28c1123..cb6ac7b32 100644
--- a/src/lib/isISO6346.js
+++ b/src/lib/isISO6346.js
@@ -3,7 +3,7 @@ import assertString from './util/assertString';
 // https://en.wikipedia.org/wiki/ISO_6346
 // according to ISO6346 standard, checksum digit is mandatory for freight container but recommended
 // for other container types (J and Z)
-const isISO6346Str = /^[A-Z]{3}(U[0-9]{7})|([J,Z][0-9]{6,7})$/;
+const isISO6346Str = /^[A-Z]{3}(U[0-9]{7}|[JZ][0-9]{6,7})$/;
 const isDigit = /^[0-9]$/;
 
 export function isISO6346(str) {
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..bc1484e55 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -13615,6 +13615,10 @@ describe('Validators', () => {
         'ECMJ4657496',
         'TBJA7176445',
         'AFFU5962593',
+        'ABCU1234567HELLO', // leading prefix matched, trailing junk ignored (anchoring bug)
+        'CSQU3054383XXX', // valid container id with trailing junk
+        'hellozZ123456', // trailing digits matched, missing owner prefix
+        'AB,123456', // literal comma accepted by [J,Z] character class
       ],
     });
   });