From a5bc3298b99938ea5f7bc1dfa614bb3ad5513a86 Mon Sep 17 00:00:00 2001
From: Bipin Budhathoki <bipinbudhathoki01@gmail.com>
Date: Tue, 3 Nov 2026 23:10:10 +0545
Subject: [PATCH] fix(isISBN): require an ISBN prefix for ISBN-13 values

---
 README.md                      |  2 +-
 src/lib/isISBN.js              |  2 +-
 test/validators/isISBN.test.js | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index e8b7aedd9..91ec627e9 100644
--- a/README.md
+++ b/README.md
@@ -125,7 +125,7 @@ Validator                               | Description
 **isInt(str [, options])**              | check if the string is an integer.<br/><br/>`options` is an object which can contain the keys `min` and/or `max` to check the integer is within boundaries (e.g. `{ min: 10, max: 99 }`). `options` can also contain the key `allow_leading_zeroes`, which when set to false will disallow integer values with leading zeroes (e.g. `{ allow_leading_zeroes: false }`). Finally, `options` can contain the keys `gt` and/or `lt` which will enforce integers being greater than or less than, respectively, the value provided (e.g. `{gt: 1, lt: 4}` for a number between 1 and 4).
 **isIP(str [, options])**               | check if the string is an IP address (version 4 or 6).<br/><br/>`options` is an object that defaults to `{ version: '' }`.<br/><br/>**Options:**<br/>`version`: defines which IP version to compare to. Accepted values: `4`, `6`, `'4'`, `'6'`.
 **isIPRange(str [, version])**          | check if the string is an IP Range (version 4 or 6).
-**isISBN(str [, options])**             | check if the string is an [ISBN][ISBN].<br/><br/>`options` is an object that has no default.<br/>**Options:**<br/>`version`: ISBN version to compare to. Accepted values are '10' and '13'. If none provided, both will be tested.
+**isISBN(str [, options])**             | check if the string is an [ISBN][ISBN]. ISBN-13 values must begin with `978` or `979` and have a valid check digit; EAN-13 values with other prefixes are rejected.<br/><br/>`options` is an object that has no default.<br/>**Options:**<br/>`version`: ISBN version to compare to. Accepted values are '10' and '13'. If none provided, both will be tested.
 **isISIN(str)**                         | check if the string is an [ISIN][ISIN] (stock/security identifier).
 **isISO6346(str)**                      | check if the string is a valid [ISO 6346](https://en.wikipedia.org/wiki/ISO_6346) shipping container identification.
 **isISO6391(str)**                      | check if the string is a valid [ISO 639-1][ISO 639-1] language code.
diff --git a/src/lib/isISBN.js b/src/lib/isISBN.js
index 4499c59a0..6e17d8b4e 100644
--- a/src/lib/isISBN.js
+++ b/src/lib/isISBN.js
@@ -1,7 +1,7 @@
 import assertString from './util/assertString';
 
 const possibleIsbn10 = /^(?:[0-9]{9}X|[0-9]{10})$/;
-const possibleIsbn13 = /^(?:[0-9]{13})$/;
+const possibleIsbn13 = /^97[89][0-9]{10}$/;
 const factor = [1, 3];
 
 export default function isISBN(isbn, options) {
diff --git a/test/validators/isISBN.test.js b/test/validators/isISBN.test.js
index 99fb2e014..475ad90b8 100644
--- a/test/validators/isISBN.test.js
+++ b/test/validators/isISBN.test.js
@@ -1,6 +1,24 @@
 import test from '../testFunctions';
 
 describe('isISBN', () => {
+  [undefined, 13, '13', { version: 13 }, { version: '13' }].forEach((options) => {
+    it(`should require an ISBN-13 prefix with options ${JSON.stringify(options)}`, () => {
+      test({
+        validator: 'isISBN',
+        args: options === undefined ? [] : [options],
+        valid: [
+          '9783836221191', '978-3-8362-2119-1', '978 3 8362 2119 1',
+          '9791090636071', '979-10-90636-07-1', '979 10 90636 07 1',
+        ],
+        invalid: [
+          '4006381333931', '400-6381333931', '400 6381333931',
+          '1234567890128', '0000000000000',
+          '9783836221190', '9791090636070',
+        ],
+      });
+    });
+  });
+
   it('should validate ISBNs', () => {
     test({
       validator: 'isISBN',