From 0e2554afd5b4fde561b004621e1451ca475d2a10 Mon Sep 17 00:00:00 2001
From: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
Date: Thu, 30 Jul 2026 00:31:51 -0700
Subject: [PATCH] fix(isFloat): reject bare-exponent strings like "e5"

isFloat returned true for strings that are only an exponent with no
mantissa ("e5", "E5", ".e3", "e-3", "+e5") because every segment of
the validation regex is optional. parseFloat returns NaN for these, so
the values are not floats.

Guard the result with !Number.isNaN(value). Computing value with a
locale-aware decimal separator (instead of a hardcoded comma) keeps the
NaN check correct for non-'.'/',' locales such as ar-JO.
---
 src/lib/isFloat.js      | 6 ++++--
 test/validators.test.js | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/lib/isFloat.js b/src/lib/isFloat.js
index 84bdc782c..b66158933 100644
--- a/src/lib/isFloat.js
+++ b/src/lib/isFloat.js
@@ -5,12 +5,14 @@ import { decimal } from './alpha';
 export default function isFloat(str, options) {
   assertString(str);
   options = options || {};
-  const float = new RegExp(`^(?:[-+])?(?:[0-9]+)?(?:\\${options.locale ? decimal[options.locale] : '.'}[0-9]*)?(?:[eE][\\+\\-]?(?:[0-9]+))?$`);
+  const decimalSeparator = options.locale ? decimal[options.locale] : '.';
+  const float = new RegExp(`^(?:[-+])?(?:[0-9]+)?(?:\\${decimalSeparator}[0-9]*)?(?:[eE][\\+\\-]?(?:[0-9]+))?$`);
   if (str === '' || str === '.' || str === ',' || str === '-' || str === '+') {
     return false;
   }
-  const value = parseFloat(str.replace(',', '.'));
+  const value = parseFloat(str.replace(decimalSeparator, '.'));
   return float.test(str) &&
+    !Number.isNaN(value) &&
     (!options.hasOwnProperty('min') || isNullOrUndefined(options.min) || value >= options.min) &&
     (!options.hasOwnProperty('max') || isNullOrUndefined(options.max) || value <= options.max) &&
     (!options.hasOwnProperty('lt') || isNullOrUndefined(options.lt) || value < options.lt) &&
diff --git a/test/validators.test.js b/test/validators.test.js
index cdde41a07..873f9d1db 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -4657,6 +4657,11 @@ describe('Validators', () => {
         'foo',
         '20.foo',
         '2020-01-06T14:31:00.135Z',
+        'e5',
+        'E5',
+        '.e3',
+        'e-3',
+        '+e5',
       ],
     });