From 1311a260c1c07ffe2a96720a24aa961ba0f8a3d7 Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Fri, 23 Oct 2026 10:18:43 +0900 Subject: [PATCH 1/2] fix: Limit the Mastercard 2-series range to 2221-2720 The pattern 2[2-7] accepted every prefix from 2200 to 2799, but Mastercard only issues 2-series cards in the 222100-272099 BIN range, so numbers such as 2200 (Mir) were wrongly accepted as Mastercard. --- src/Validators/CreditCard.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Validators/CreditCard.php b/src/Validators/CreditCard.php index 7dbeb75b8..261f965ed 100644 --- a/src/Validators/CreditCard.php +++ b/src/Validators/CreditCard.php @@ -61,7 +61,7 @@ self::DINERS_CLUB => '/^3(?:0[0-5]|[68]\d)\d{11}$/', self::DISCOVER => '/^6(?:011|5\d{2})\d{12}$/', self::JCB => '/^(?:2131|1800|35\d{3})\d{11}$/', - self::MASTERCARD => '/^(5[1-5]|2[2-7])\d{14}$/', + self::MASTERCARD => '/^(?:5[1-5]\d{2}|222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)\d{12}$/', self::VISA => '/^4\d{12}(?:\d{3})?$/', self::RUPAY => '/^6(?!011)(?:0[0-9]{14}|52[12][0-9]{12})$/', ]; From 36ebf1aec682cbefb37a6b3ba6d6e4460ad928fd Mon Sep 17 00:00:00 2001 From: Application-drop-up Date: Fri, 23 Oct 2026 10:19:58 +0900 Subject: [PATCH 2/2] test: Test the Mastercard 2-series range boundaries Cover the lower (2221) and upper (2720) bounds, plus Luhn-valid numbers just outside the range (2200, 2721) that must be rejected. --- tests/unit/Validators/CreditCardTest.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/unit/Validators/CreditCardTest.php b/tests/unit/Validators/CreditCardTest.php index b396f23ff..3f14d3d55 100644 --- a/tests/unit/Validators/CreditCardTest.php +++ b/tests/unit/Validators/CreditCardTest.php @@ -52,6 +52,8 @@ public static function providerForValidInput(): iterable [$master, '5376 7473 9720 8720'], [$general, '2223000048400011'], // MasterCard 2 BIN Range [$master, '2222 4000 4124 0011'], + [$master, '2221000000000009'], // MasterCard 2 BIN Range lower bound + [$master, '2720000000000005'], // MasterCard 2 BIN Range upper bound [$general, '4024.0071.5336.1885'], // Visa 16 [$visa, '4024.0071.5336.1885'], [$general, '4024 007 193 879'], // Visa 13 @@ -94,6 +96,8 @@ public static function providerForInvalidInput(): iterable [$diners, '4012888888881881'], // Visa [$discover, '371449635398431'], // American Express [$jcb, '38520000023237'], // Diners Club + [$master, '2200000000000004'], // Luhn-valid, below the MasterCard 2 BIN Range (2221) + [$master, '2721000000000004'], // Luhn-valid, above the MasterCard 2 BIN Range (2720) [$master, '05105105105105100'], // Over-long (17-digit) Luhn-valid number; regression for missing ^ anchor ]; }