fix(isFQDN): reject unpaired UTF-16 surrogates

src/lib/isFQDN.js

@@ -12,6 +12,12 @@ const default_fqdn_options = {
 
 export default function isFQDN(str, options) {
   assertString(str);
+
+  // Reject unpaired surrogates while preserving valid surrogate pairs.
+  if (/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(str)) {
+    return false;
+  }
+
   options = merge(options, default_fqdn_options);
 
   /* Remove the optional trailing dot before checking validity */

test/validators.test.js

@@ -5785,9 +5785,26 @@ describe('Validators', () => {
   });
 
   it('should reject emails containing unpaired UTF-16 surrogates without throwing', () => {
-    test({
-      validator: 'isEmail',
-      invalid: ['\uD800@example.com', '\uDC00@example.com'],
+    [undefined, { ignore_max_length: true }].forEach((options) => {
+      test({
+        validator: 'isEmail',
+        args: [options],
+        valid: ['user@example.com', 'user@é.com', 'user@\uD83D\uDE00.com', 'user@a\uD83D\uDE00b.com'],
+        invalid: [
+          '\uD800@example.com',
+          '\uDC00@example.com',
+          'user@\uD800.com',
+          'user@\uDC00.com',
+          'user@\uD800abc.com',
+          'user@\uDC00abc.com',
+          'user@a\uD800b.com',
+          'user@a\uDC00b.com',
+          'user@abc\uD800.com',
+          'user@abc\uDC00.com',
+          'user@\uD83D\uDE00\uDC00.com',
+          'user@\uD800\uD83D\uDE00.com',
+        ],
+      });
     });
   });
 

test/validators/isFQDN.test.js

@@ -1,6 +1,28 @@
 import test from '../testFunctions';
 
 describe('isFQDN', () => {
+  it('should reject unpaired UTF-16 surrogates without throwing', () => {
+    [undefined, { ignore_max_length: true }].forEach((options) => {
+      test({
+        validator: 'isFQDN',
+        args: [options],
+        valid: ['example.com', 'é.com', '\uD83D\uDE00.com', 'a\uD83D\uDE00b.com'],
+        invalid: [
+          '\uD800.com',
+          '\uDC00.com',
+          '\uD800abc.com',
+          '\uDC00abc.com',
+          'a\uD800b.com',
+          'a\uDC00b.com',
+          'abc\uD800.com',
+          'abc\uDC00.com',
+          '\uD83D\uDE00\uDC00.com',
+          '\uD800\uD83D\uDE00.com',
+        ],
+      });
+    });
+  });
+
   it('should validate domain names.', () => {
     test({
       validator: 'isFQDN',