From 310f6c87627cd7d2dc64a6168784e6f5d3f9d812 Mon Sep 17 00:00:00 2001
From: simonkundrik <117163790+simonkundrik@users.noreply.github.com>
Date: Mon, 6 Jul 2026 16:04:15 +0300
Subject: [PATCH 1/2] fix(isVAT): reject stray comma in Dominican Republic (DO)
 VAT numbers

The `DO` matcher used the character class `[1,4,5]`, which matches a
literal comma in addition to the digits 1, 4 and 5. As a result,
strings beginning with a comma were accepted, e.g.
`isVAT(',12345678', 'DO')` returned `true`.

Use `[145]` instead so only the intended digits are matched, and add
regression tests for the previously-accepted comma inputs.
---
 src/lib/isVAT.js        | 2 +-
 test/validators.test.js | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/lib/isVAT.js b/src/lib/isVAT.js
index 1ec2c5991..91eb3029a 100644
--- a/src/lib/isVAT.js
+++ b/src/lib/isVAT.js
@@ -124,7 +124,7 @@ export const vatMatchers = {
   PA: str => /^(PA)?$/.test(str),
   PY: str => /^(PY)?\d{6,8}-\d{1}$/.test(str),
   PE: str => /^(PE)?\d{11}$/.test(str),
-  DO: str => /^(DO)?(\d{11}|(\d{3}-\d{7}-\d{1})|[1,4,5]{1}\d{8}|([1,4,5]{1})-\d{2}-\d{5}-\d{1})$/.test(str),
+  DO: str => /^(DO)?(\d{11}|(\d{3}-\d{7}-\d{1})|[145]{1}\d{8}|([145]{1})-\d{2}-\d{5}-\d{1})$/.test(str),
   UY: str => /^(UY)?\d{12}$/.test(str),
   VE: str => /^(VE)?[J,G,V,E]{1}-(\d{9}|(\d{8}-\d{1}))$/.test(str),
 };
diff --git a/test/validators.test.js b/test/validators.test.js
index 9c867efae..80239af84 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -16026,6 +16026,8 @@ describe('Validators', () => {
       invalid: [
         'DO 12345678901',
         '1234567890',
+        ',12345678',
+        ',-12-34567-8',
       ],
     });
     test({

From baf8fd5f05efcb32213e76ad87947769e1afc3f4 Mon Sep 17 00:00:00 2001
From: simonkundrik <117163790+simonkundrik@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:24:29 +0300
Subject: [PATCH 2/2] fix(isVAT): reject stray comma in Venezuela (VE) VAT
 numbers too

The `VE` matcher's `[J,G,V,E]` character class has the same
literal-comma bug as `DO`: it accepts a stray comma in addition to the
intended letters J, G, V and E. Use `[JGVE]` and add regression tests.
---
 src/lib/isVAT.js        | 2 +-
 test/validators.test.js | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/lib/isVAT.js b/src/lib/isVAT.js
index 91eb3029a..68aab5c12 100644
--- a/src/lib/isVAT.js
+++ b/src/lib/isVAT.js
@@ -126,7 +126,7 @@ export const vatMatchers = {
   PE: str => /^(PE)?\d{11}$/.test(str),
   DO: str => /^(DO)?(\d{11}|(\d{3}-\d{7}-\d{1})|[145]{1}\d{8}|([145]{1})-\d{2}-\d{5}-\d{1})$/.test(str),
   UY: str => /^(UY)?\d{12}$/.test(str),
-  VE: str => /^(VE)?[J,G,V,E]{1}-(\d{9}|(\d{8}-\d{1}))$/.test(str),
+  VE: str => /^(VE)?[JGVE]{1}-(\d{9}|(\d{8}-\d{1}))$/.test(str),
 };
 
 export default function isVAT(str, countryCode) {
diff --git a/test/validators.test.js b/test/validators.test.js
index 80239af84..c3703329b 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -16054,6 +16054,8 @@ describe('Validators', () => {
       invalid: [
         'VE J-123456789',
         '12345678',
+        ',-123456789',
+        ',-12345678-9',
       ],
     });
     test({