From 711119f5bb003f53bf732244e98895421d7a99b3 Mon Sep 17 00:00:00 2001
From: yfwmaniish <manishtiwari5398@gmail.com>
Date: Tue, 1 Sep 2026 10:37:08 +0530
Subject: [PATCH] fix(isISO8601): reject non-space whitespace as the date-time
 separator

The default (non-strictSeparator) regex used [T\s] for the date-time
separator. \s matches tab, newline, form feed, vertical tab, and
non-breaking space in addition to a plain space, so all of them were
accepted between the date and time parts.

ISO 8601 permits only 'T'; RFC 3339 SS5.6 additionally allows a plain
space by convention, which is presumably why the class was there, but
neither spec permits the rest of \s -- a newline in particular lets a
two-line input pass a single-value check.

Change [T\s] to [T ] so only 'T' or a literal space separates the
date and time. strictSeparator was already unaffected (it only ever
allowed [T]).

Fixes #2861
---
 src/lib/isISO8601.js    | 2 +-
 test/validators.test.js | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/lib/isISO8601.js b/src/lib/isISO8601.js
index 6eea9ae27..873aec756 100644
--- a/src/lib/isISO8601.js
+++ b/src/lib/isISO8601.js
@@ -2,7 +2,7 @@ import assertString from './util/assertString';
 
 /* eslint-disable max-len */
 // from http://goo.gl/0ejHHW
-const iso8601 = /^([\+-]?\d{4}(?!\d{2}\b))((-?)((0[1-9]|1[0-2])(\3([12]\d|0[1-9]|3[01]))?|W(0[1-9]|[1-4]\d|5[0-3])(-?[1-7])?|(00[1-9]|0[1-9]\d|[12]\d{2}|3([0-5]\d|6[0-6])))([T\s]((([01]\d|2[0-3])((:?)[0-5]\d)?|24:?00)([\.,]\d+(?!:))?)?(\17[0-5]\d([\.,]\d+)?)?([zZ]|([\+-])([01]\d|2[0-3]):?([0-5]\d)?)?)?)?$/;
+const iso8601 = /^([\+-]?\d{4}(?!\d{2}\b))((-?)((0[1-9]|1[0-2])(\3([12]\d|0[1-9]|3[01]))?|W(0[1-9]|[1-4]\d|5[0-3])(-?[1-7])?|(00[1-9]|0[1-9]\d|[12]\d{2}|3([0-5]\d|6[0-6])))([T ]((([01]\d|2[0-3])((:?)[0-5]\d)?|24:?00)([\.,]\d+(?!:))?)?(\17[0-5]\d([\.,]\d+)?)?([zZ]|([\+-])([01]\d|2[0-3]):?([0-5]\d)?)?)?)?$/;
 // same as above, except with a strict 'T' separator between date and time
 const iso8601StrictSeparator = /^([\+-]?\d{4}(?!\d{2}\b))((-?)((0[1-9]|1[0-2])(\3([12]\d|0[1-9]|3[01]))?|W(0[1-9]|[1-4]\d|5[0-3])(-?[1-7])?|(00[1-9]|0[1-9]\d|[12]\d{2}|3([0-5]\d|6[0-6])))([T]((([01]\d|2[0-3])((:?)[0-5]\d)?|24:?00)([\.,]\d+(?!:))?)?(\17[0-5]\d([\.,]\d+)?)?([zZ]|([\+-])([01]\d|2[0-3]):?([0-5]\d)?)?)?)?$/;
 /* eslint-enable max-len */
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..f52666eb2 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -12409,6 +12409,11 @@ describe('Validators', () => {
     '2009-W00-1',
     '2024-W00',
     '2020-W00-7',
+    '2009-01-01\t00:00:00',
+    '2009-01-01\n00:00:00',
+    '2009-01-01\f00:00:00',
+    '2009-01-01\v00:00:00',
+    '2009-01-01 00:00:00',
   ];
 
   it('should validate ISO 8601 dates', () => {