From 4c92074f995c1e7df661be70f17a1fd88782afbc Mon Sep 17 00:00:00 2001
From: minhal128 <rizvi4600779@cloud.neduet.edu.pk>
Date: Tue, 29 Sep 2026 22:26:02 +0500
Subject: [PATCH] fix(isFloat): reject an unknown locale instead of building a
 broken pattern

When options.locale is not a key of the decimal table the lookup yields
undefined, which is interpolated into the separator group as the literal
text undefined. The validator then accepts '3undefined5' and rejects
'3.5'. isDecimal, which reads the same table, already throws for an
unknown locale; do the same here.

Fixes #2862

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/isFloat.js      | 3 +++
 test/validators.test.js | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/src/lib/isFloat.js b/src/lib/isFloat.js
index 84bdc782c..9fe2d602b 100644
--- a/src/lib/isFloat.js
+++ b/src/lib/isFloat.js
@@ -5,6 +5,9 @@ import { decimal } from './alpha';
 export default function isFloat(str, options) {
   assertString(str);
   options = options || {};
+  if (options.locale && !(options.locale in decimal)) {
+    throw new Error(`Invalid locale '${options.locale}'`);
+  }
   const float = new RegExp(`^(?:[-+])?(?:[0-9]+)?(?:\\${options.locale ? decimal[options.locale] : '.'}[0-9]*)?(?:[eE][\\+\\-]?(?:[0-9]+))?$`);
   if (str === '' || str === '.' || str === ',' || str === '-' || str === '+') {
     return false;
diff --git a/test/validators.test.js b/test/validators.test.js
index 98d2a12ff..2c76de2d1 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -4938,6 +4938,14 @@ describe('Validators', () => {
         '22.3',
       ],
     });
+    test({
+      validator: 'isFloat',
+      args: [{ locale: 'de-CH' }],
+      error: [
+        '123.123',
+        '3undefined5',
+      ],
+    });
   });
 
   it('should validate hexadecimal strings', () => {