diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af090a9be..e0024eff3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [22, 20, 18, 16, 14, 12, 10, 8, 6]
+        node-version: [22, 20, 18, 16, 14, 12, 10, 8]
     name: Run tests on Node.js ${{ matrix.node-version }}
     steps:
     - name: Setup Node.js ${{ matrix.node-version }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 549377fd2..25192b24a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+# 13.15.20
+
+### Fixes, New Locales and Enhancements
+
+- [#2556](https://github.com/validatorjs/validator.js/pull/2556) `isMobilePhone`: add `ar-QA` locale @WardKhaddour
+- [#2576](https://github.com/validatorjs/validator.js/pull/2576) `isAlpha`/`isAlphanuneric`: add Indic locales (`ta-IN`, `te-IN`, `kn-IN`, `ml-IN`, `gu-IN`, `pa-IN`, `or-IN`) @avadootharajesh
+- [#2574](https://github.com/validatorjs/validator.js/pull/2574) `isBase64`: improve padding regex @KrayzeeKev
+- [#2584](https://github.com/validatorjs/validator.js/pull/2584) `isVAT`: improve `FR` locale @iamAmer
+- [#2608](https://github.com/validatorjs/validator.js/pull/2608) `isURL`: improve protocol detection. Resolves CVE-2025-56200 @theofidry
+- **Doc fixes and others:**
+  - [#2563](https://github.com/validatorjs/validator.js/pull/2563) @stoneLeaf
+  - [#2581](https://github.com/validatorjs/validator.js/pull/2581) @camillobruni
+
 # 13.15.15
 
 ### Fixes, New Locales and Enhancements
diff --git a/README.md b/README.md
index 592e661bf..37fbd5e3d 100644
--- a/README.md
+++ b/README.md
@@ -88,8 +88,8 @@ Validator                               | Description
 **equals(str, comparison)**             | check if the string matches the comparison.
 **isAbaRouting(str)**               | check if the string is an ABA routing number for US bank account / cheque.
 **isAfter(str [, options])**            | check if the string is a date that is after the specified date.<br/><br/>`options` is an object that defaults to `{ comparisonDate: Date().toString() }`.<br/>**Options:**<br/>`comparisonDate`: Date to compare to. Defaults to `Date().toString()` (now).
-**isAlpha(str [, locale, options])**    | check if the string contains only letters (a-zA-Z).<br/><br/>`locale` is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bg-BG', 'bn', 'cs-CZ', 'da-DK', 'de-DE', 'el-GR', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fa-IR', 'fi-FI', 'fr-CA', 'fr-FR', 'he', 'hi-IN', 'hu-HU', 'it-IT', 'kk-KZ', 'ko-KR', 'ja-JP', 'ku-IQ', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'si-LK', 'sl-SI', 'sk-SK', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'th-TH', 'tr-TR', 'uk-UA']` and defaults to `en-US`. Locale list is `validator.isAlphaLocales`. `options` is an optional object that can be supplied with the following key(s): `ignore` which can either be a String or RegExp of characters to be ignored e.g. " -" will ignore spaces and -'s.
-**isAlphanumeric(str [, locale, options])**      | check if the string contains only letters and numbers (a-zA-Z0-9).<br/><br/>`locale` is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bn', 'bg-BG', 'cs-CZ', 'da-DK', 'de-DE', 'el-GR', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fa-IR', 'fi-FI', 'fr-CA', 'fr-FR', 'he', 'hi-IN', 'hu-HU', 'it-IT', 'kk-KZ', 'ko-KR', 'ja-JP','ku-IQ', 'nb-NO', 'nl-NL', 'nn-NO', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'si-LK', 'sl-SI', 'sk-SK', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'th-TH', 'tr-TR', 'uk-UA']`) and defaults to `en-US`. Locale list is `validator.isAlphanumericLocales`. `options` is an optional object that can be supplied with the following key(s): `ignore` which can either be a String or RegExp of characters to be ignored e.g. " -" will ignore spaces and -'s.
+**isAlpha(str [, locale, options])**    | check if the string contains only letters (a-zA-Z).<br/><br/>`locale` is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bg-BG', 'bn', 'bn-IN', 'cs-CZ', 'da-DK', 'de-DE', 'el-GR', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fa-IR', 'fi-FI', 'fr-CA', 'fr-FR', 'gu-IN', 'he', 'hi-IN', 'hu-HU', 'it-IT', 'ja-JP', 'kk-KZ', 'kn-IN', 'ko-KR', 'ku-IQ', 'ml-IN', 'nb-NO', 'nl-NL', 'nn-NO', 'or-IN', 'pa-IN', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'si-LK', 'sk-SK', 'sl-SI', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'ta-IN', 'te-IN', 'th-TH', 'tr-TR', 'uk-UA']` and defaults to `en-US`. Locale list is `validator.isAlphaLocales`. `options` is an optional object that can be supplied with the following key(s): `ignore` which can either be a String or RegExp of characters to be ignored e.g. " -" will ignore spaces and -'s.
+**isAlphanumeric(str [, locale, options])**      | check if the string contains only letters and numbers (a-zA-Z0-9).<br/><br/>`locale` is one of `['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'bg-BG', 'bn', 'bn-IN', 'cs-CZ', 'da-DK', 'de-DE', 'el-GR', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'eo', 'es-ES', 'fa-IR', 'fi-FI', 'fr-CA', 'fr-FR', 'gu-IN', 'he', 'hi-IN', 'hu-HU', 'it-IT', 'ja-JP', 'kk-KZ', 'kn-IN', 'ko-KR', 'ku-IQ', 'ml-IN', 'nb-NO', 'nl-NL', 'nn-NO', 'or-IN', 'pa-IN', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'si-LK', 'sk-SK', 'sl-SI', 'sr-RS', 'sr-RS@latin', 'sv-SE', 'ta-IN', 'te-IN', 'th-TH', 'tr-TR', 'uk-UA']`) and defaults to `en-US`. Locale list is `validator.isAlphanumericLocales`. `options` is an optional object that can be supplied with the following key(s): `ignore` which can either be a String or RegExp of characters to be ignored e.g. " -" will ignore spaces and -'s.
 **isAscii(str)**                        | check if the string contains ASCII chars only.
 **isBase32(str [, options])**           | check if the string is base32 encoded. `options` is optional and defaults to `{ crockford: false }`.<br/> When `crockford` is true it tests the given base32 encoded string using [Crockford's base32 alternative][Crockford Base32].
 **isBase58(str)**                       | check if the string is base58 encoded.
@@ -145,7 +145,7 @@ Validator                               | Description
 **isLocale(str)**                       | check if the string is a locale.
 **isLowercase(str)**                    | check if the string is lowercase.
 **isLuhnNumber(str)**                    | check if the string passes the [Luhn algorithm check](https://en.wikipedia.org/wiki/Luhn_algorithm).
-**isMACAddress(str [, options])**                   | check if the string is a MAC address.<br/><br/>`options` is an object which defaults to `{ no_separators: false }`. If `no_separators` is true, the validator will allow MAC addresses without separators. Also, it allows the use of hyphens, spaces or dots e.g. '01 02 03 04 05 ab', '01-02-03-04-05-ab' or '0102.0304.05ab'. The options also allow a `eui` property to specify if it needs to be validated against EUI-48 or EUI-64. The accepted values of `eui` are: 48, 64.
+**isMACAddress(str [, options])**                   | check if the string is a MAC address.<br/><br/>`options` is an object which defaults to `{ no_separators: false }`. It allows the use of hyphens, spaces or dots e.g. '01 02 03 04 05 ab', '01-02-03-04-05-ab' or '0102.0304.05ab'. If `no_separators` is true, the validator will then only check MAC addresses without separators. The options also allow a `eui` property to specify if it needs to be validated against EUI-48 or EUI-64. The accepted values of `eui` are: 48, 64.
 **isMagnetURI(str)**                      | check if the string is a [Magnet URI format][Magnet URI Format].
 **isMailtoURI(str, [, options])**                      | check if the string is a [Mailto URI format][Mailto URI Format].<br/><br/>`options` is an object of validating emails inside the URI (check `isEmail`s options for details).
 **isMD5(str)**                          | check if the string is a MD5 hash.<br/><br/>Please note that you can also use the `isHash(str, 'md5')` function. Keep in mind that MD5 has some collision weaknesses compared to other algorithms (e.g., SHA).
@@ -167,7 +167,7 @@ Validator                               | Description
 **isStrongPassword(str [, options])**   | check if the string can be considered a strong password or not. Allows for custom requirements or scoring rules. If `returnScore` is true, then the function returns an integer score for the password rather than a boolean.<br/>Default options: <br/>`{ minLength: 8, minLowercase: 1, minUppercase: 1, minNumbers: 1, minSymbols: 1, returnScore: false, pointsPerUnique: 1, pointsPerRepeat: 0.5, pointsForContainingLower: 10, pointsForContainingUpper: 10, pointsForContainingNumber: 10, pointsForContainingSymbol: 10 }`
 **isTime(str [, options])**             | check if the string is a valid time e.g. [`23:01:59`, new Date().toLocaleTimeString()].<br/><br/> `options` is an object which can contain the keys `hourFormat` or `mode`.<br/><br/>`hourFormat` is a key and defaults to `'hour24'`.<br/><br/>`mode` is a key and defaults to `'default'`. <br/><br/>`hourFormat` can contain the values `'hour12'` or `'hour24'`, `'hour24'` will validate hours in 24 format and `'hour12'` will validate hours in 12 format. <br/><br/>`mode` can contain the values `'default', 'withSeconds', withOptionalSeconds`, `'default'` will validate `HH:MM` format, `'withSeconds'` will validate the `HH:MM:SS` format, `'withOptionalSeconds'` will validate `'HH:MM'` and `'HH:MM:SS'` formats.
 **isTaxID(str, locale)**                | check if the string is a valid Tax Identification Number. Default locale is `en-US`.<br/><br/>More info about exact TIN support can be found in `src/lib/isTaxID.js`.<br/><br/>Supported locales: `[ 'bg-BG', 'cs-CZ', 'de-AT', 'de-DE', 'dk-DK', 'el-CY', 'el-GR', 'en-CA', 'en-GB', 'en-IE', 'en-US', 'es-AR', 'es-ES', 'et-EE', 'fi-FI', 'fr-BE', 'fr-CA', 'fr-FR', 'fr-LU', 'hr-HR', 'hu-HU', 'it-IT', 'lb-LU', 'lt-LT', 'lv-LV', 'mt-MT', 'nl-BE', 'nl-NL', 'pl-PL', 'pt-BR', 'pt-PT', 'ro-RO', 'sk-SK', 'sl-SI', 'sv-SE', 'uk-UA']`.
-**isURL(str [, options])**              | check if the string is a URL.<br/><br/>`options` is an object which defaults to `{ protocols: ['http','https','ftp'], require_tld: true, require_protocol: false, require_host: true, require_port: false, require_valid_protocol: true, allow_underscores: false, host_whitelist: false, host_blacklist: false, allow_trailing_dot: false, allow_protocol_relative_urls: false, allow_fragments: true, allow_query_components: true, disallow_auth: false, validate_length: true }`.<br/><br/>`protocols` - valid protocols can be modified with this option.<br/>`require_tld` - If set to false isURL will not check if the URL's host includes a top-level domain.<br/>`require_protocol` - if set to true isURL will return false if protocol is not present in the URL.<br/>`require_host` - if set to false isURL will not check if host is present in the URL.<br/>`require_port` - if set to true isURL will check if port is present in the URL.<br/>`require_valid_protocol` - isURL will check if the URL's protocol is present in the protocols option.<br/>`allow_underscores` - if set to true, the validator will allow underscores in the URL.<br/>`host_whitelist` - if set to an array of strings or regexp, and the domain matches none of the strings defined in it, the validation fails.<br/>`host_blacklist` - if set to an array of strings or regexp, and the domain matches any of the strings defined in it, the validation fails.<br/>`allow_trailing_dot` - if set to true, the validator will allow the domain to end with a `.` character.<br/>`allow_protocol_relative_urls` - if set to true protocol relative URLs will be allowed.<br/>`allow_fragments` - if set to false isURL will return false if fragments are present.<br/>`allow_query_components` - if set to false isURL will return false if query components are present.<br/>`disallow_auth` - if set to true, the validator will fail if the URL contains an authentication component, e.g. `http://username:password@example.com`.<br/>`validate_length` - if set to false isURL will skip string length validation. `max_allowed_length` will be ignored if this is set as `false`.<br/>`max_allowed_length` - if set, isURL will not allow URLs longer than the specified value (default is 2084 that IE maximum URL length).<br/>
+**isURL(str [, options])**              | check if the string is a URL.<br/><br/>`options` is an object which defaults to `{ protocols: ['http','https','ftp'], require_tld: true, require_protocol: false, require_host: true, require_port: false, require_valid_protocol: true, allow_underscores: false, host_whitelist: false, host_blacklist: false, allow_trailing_dot: false, allow_protocol_relative_urls: false, allow_fragments: true, allow_query_components: true, disallow_auth: false, validate_length: true }`.<br/><br/>`protocols` - valid protocols can be modified with this option.<br/>`require_tld` - If set to false isURL will not check if the URL's host includes a top-level domain.<br/>`require_protocol` - **RECOMMENDED** if set to true isURL will return false if protocol is not present in the URL. Without this setting, some malicious URLs cannot be distinguishable from a valid URL with authentication information.<br/>`require_host` - if set to false isURL will not check if host is present in the URL.<br/>`require_port` - if set to true isURL will check if port is present in the URL.<br/>`require_valid_protocol` - isURL will check if the URL's protocol is present in the protocols option.<br/>`allow_underscores` - if set to true, the validator will allow underscores in the URL.<br/>`host_whitelist` - if set to an array of strings or regexp, and the domain matches none of the strings defined in it, the validation fails.<br/>`host_blacklist` - if set to an array of strings or regexp, and the domain matches any of the strings defined in it, the validation fails.<br/>`allow_trailing_dot` - if set to true, the validator will allow the domain to end with a `.` character.<br/>`allow_protocol_relative_urls` - if set to true protocol relative URLs will be allowed.<br/>`allow_fragments` - if set to false isURL will return false if fragments are present.<br/>`allow_query_components` - if set to false isURL will return false if query components are present.<br/>`disallow_auth` - if set to true, the validator will fail if the URL contains an authentication component, e.g. `http://username:password@example.com`.<br/>`validate_length` - if set to false isURL will skip string length validation. `max_allowed_length` will be ignored if this is set as `false`.<br/>`max_allowed_length` - if set, isURL will not allow URLs longer than the specified value (default is 2084 that IE maximum URL length).<br/>
 **isULID(str)**                         | check if the string is a [ULID](https://github.com/ulid/spec).
 **isUUID(str [, version])**             | check if the string is an RFC9562 UUID.<br/>`version` is one of `'1'`-`'8'`, `'nil'`, `'max'`, `'all'` or `'loose'`. The `'loose'` option checks if the string is a UUID-like string with hexadecimal values, ignoring RFC9565.
 **isVariableWidth(str)**                | check if the string contains a mixture of full and half-width chars.
diff --git a/package.json b/package.json
index 7e84ef71d..106694955 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "validator",
   "description": "String validation and sanitization",
-  "version": "13.15.15",
+  "version": "13.15.20",
   "sideEffects": false,
   "homepage": "https://github.com/validatorjs/validator.js",
   "files": [
diff --git a/src/index.js b/src/index.js
index 87be7113c..b69c43649 100644
--- a/src/index.js
+++ b/src/index.js
@@ -130,7 +130,7 @@ import isStrongPassword from './lib/isStrongPassword';
 
 import isVAT from './lib/isVAT';
 
-const version = '13.15.15';
+const version = '13.15.20';
 
 const validator = {
   version,
diff --git a/src/lib/alpha.js b/src/lib/alpha.js
index 8c37934ff..6f58c9aee 100644
--- a/src/lib/alpha.js
+++ b/src/lib/alpha.js
@@ -38,6 +38,13 @@ export const alpha = {
   eo: /^[ABCĈD-GĜHĤIJĴK-PRSŜTUŬVZ]+$/i,
   'hi-IN': /^[\u0900-\u0961]+[\u0972-\u097F]*$/i,
   'si-LK': /^[\u0D80-\u0DFF]+$/,
+  'ta-IN': /^[\u0B80-\u0BFF]+$/i,
+  'te-IN': /^[\u0C00-\u0C7F]+$/i,
+  'kn-IN': /^[\u0C80-\u0CFF]+$/i,
+  'ml-IN': /^[\u0D00-\u0D7F]+$/i,
+  'gu-IN': /^[\u0A80-\u0AFF]+$/i,
+  'pa-IN': /^[\u0A00-\u0A7F]+$/i,
+  'or-IN': /^[\u0B00-\u0B7F]+$/i,
 };
 
 export const alphanumeric = {
@@ -79,6 +86,13 @@ export const alphanumeric = {
   eo: /^[0-9ABCĈD-GĜHĤIJĴK-PRSŜTUŬVZ]+$/i,
   'hi-IN': /^[\u0900-\u0963]+[\u0966-\u097F]*$/i,
   'si-LK': /^[0-9\u0D80-\u0DFF]+$/,
+  'ta-IN': /^[0-9\u0B80-\u0BFF.]+$/i,
+  'te-IN': /^[0-9\u0C00-\u0C7F.]+$/i,
+  'kn-IN': /^[0-9\u0C80-\u0CFF.]+$/i,
+  'ml-IN': /^[0-9\u0D00-\u0D7F.]+$/i,
+  'gu-IN': /^[0-9\u0A80-\u0AFF.]+$/i,
+  'pa-IN': /^[0-9\u0A00-\u0A7F.]+$/i,
+  'or-IN': /^[0-9\u0B00-\u0B7F.]+$/i,
 };
 
 export const decimal = {
@@ -128,8 +142,9 @@ for (let locale, i = 0; i < bengaliLocales.length; i++) {
 export const dotDecimal = ['ar-EG', 'ar-LB', 'ar-LY'];
 export const commaDecimal = [
   'bg-BG', 'cs-CZ', 'da-DK', 'de-DE', 'el-GR', 'en-ZM', 'eo', 'es-ES', 'fr-CA', 'fr-FR',
-  'id-ID', 'it-IT', 'ku-IQ', 'hi-IN', 'hu-HU', 'nb-NO', 'nn-NO', 'nl-NL', 'pl-PL', 'pt-PT',
-  'ru-RU', 'kk-KZ', 'si-LK', 'sl-SI', 'sr-RS@latin', 'sr-RS', 'sv-SE', 'tr-TR', 'uk-UA', 'vi-VN',
+  'gu-IN', 'hi-IN', 'hu-HU', 'id-ID', 'it-IT', 'kk-KZ', 'kn-IN', 'ku-IQ', 'ml-IN', 'nb-NO',
+  'nl-NL', 'nn-NO', 'or-IN', 'pa-IN', 'pl-PL', 'pt-PT', 'ru-RU', 'si-LK', 'sl-SI', 'sr-RS',
+  'sr-RS@latin', 'sv-SE', 'ta-IN', 'te-IN', 'tr-TR', 'uk-UA', 'vi-VN',
 ];
 
 for (let i = 0; i < dotDecimal.length; i++) {
diff --git a/src/lib/isBase64.js b/src/lib/isBase64.js
index 7eb3a5b56..fd876e4c0 100644
--- a/src/lib/isBase64.js
+++ b/src/lib/isBase64.js
@@ -1,9 +1,9 @@
 import assertString from './util/assertString';
 import merge from './util/merge';
 
-const base64WithPadding = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/;
+const base64WithPadding = /^[A-Za-z0-9+/]+={0,2}$/;
 const base64WithoutPadding = /^[A-Za-z0-9+/]+$/;
-const base64UrlWithPadding = /^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$/;
+const base64UrlWithPadding = /^[A-Za-z0-9_-]+={0,2}$/;
 const base64UrlWithoutPadding = /^[A-Za-z0-9_-]+$/;
 
 export default function isBase64(str, options) {
@@ -12,6 +12,8 @@ export default function isBase64(str, options) {
 
   if (str === '') return true;
 
+  if (options.padding && str.length % 4 !== 0) return false;
+
   let regex;
   if (options.urlSafe) {
     regex = options.padding ? base64UrlWithPadding : base64UrlWithoutPadding;
diff --git a/src/lib/isMobilePhone.js b/src/lib/isMobilePhone.js
index ec1483d65..b00391ea6 100644
--- a/src/lib/isMobilePhone.js
+++ b/src/lib/isMobilePhone.js
@@ -20,6 +20,7 @@ const phones = {
   'ar-SY': /^(!?(\+?963)|0)?9\d{8}$/,
   'ar-TN': /^(\+?216)?[2459]\d{7}$/,
   'az-AZ': /^(\+994|0)(10|5[015]|7[07]|99)\d{7}$/,
+  'ar-QA': /^(\+?974|0)?([3567]\d{7})$/,
   'bs-BA': /^((((\+|00)3876)|06))((([0-3]|[5-6])\d{6})|(4\d{7}))$/,
   'be-BY': /^(\+?375)?(24|25|29|33|44)\d{7}$/,
   'bg-BG': /^(\+?359|0)?8[789]\d{7}$/,
diff --git a/src/lib/isURL.js b/src/lib/isURL.js
index 0fec384ba..8ae971ed6 100644
--- a/src/lib/isURL.js
+++ b/src/lib/isURL.js
@@ -83,21 +83,94 @@ export default function isURL(url, options) {
   split = url.split('?');
   url = split.shift();
 
-  split = url.split('://');
-  if (split.length > 1) {
-    protocol = split.shift().toLowerCase();
+  // Replaced the 'split("://")' logic with a regex to match the protocol.
+  // This correctly identifies schemes like `javascript:` which don't use `//`.
+  // However, we need to be careful not to confuse authentication credentials (user:password@host)
+  // with protocols. A colon before an @ symbol might be part of auth, not a protocol separator.
+  const protocol_match = url.match(/^([a-z][a-z0-9+\-.]*):/i);
+  let had_explicit_protocol = false;
+
+  const cleanUpProtocol = (potential_protocol) => {
+    had_explicit_protocol = true;
+    protocol = potential_protocol.toLowerCase();
+
     if (options.require_valid_protocol && options.protocols.indexOf(protocol) === -1) {
+      // The identified protocol is not in the allowed list.
       return false;
     }
+
+    // Remove the protocol from the URL string.
+    return url.substring(protocol_match[0].length);
+  };
+
+  if (protocol_match) {
+    const potential_protocol = protocol_match[1];
+    const after_colon = url.substring(protocol_match[0].length);
+
+    // Check if what follows looks like authentication credentials (user:password@host)
+    // rather than a protocol. This happens when:
+    // 1. There's no `//` after the colon (protocols like `http://` have this)
+    // 2. There's an `@` symbol before any `/`
+    // 3. The part before `@` contains only valid auth characters (alphanumeric, -, _, ., %, :)
+    const starts_with_slashes = after_colon.slice(0, 2) === '//';
+
+    if (!starts_with_slashes) {
+      const first_slash_position = after_colon.indexOf('/');
+      const before_slash = first_slash_position === -1
+        ? after_colon
+        : after_colon.substring(0, first_slash_position);
+      const at_position = before_slash.indexOf('@');
+
+      if (at_position !== -1) {
+        const before_at = before_slash.substring(0, at_position);
+        const valid_auth_regex = /^[a-zA-Z0-9\-_.%:]*$/;
+        const is_valid_auth = valid_auth_regex.test(before_at);
+
+        if (is_valid_auth) {
+          // This looks like authentication (e.g., user:password@host), not a protocol
+          if (options.require_protocol) {
+            return false;
+          }
+
+          // Don't consume the colon; let the auth parsing handle it later
+        } else {
+          // This looks like a malicious protocol (e.g., javascript:alert();@host)
+          url = cleanUpProtocol(potential_protocol);
+
+          if (url === false) {
+            return false;
+          }
+        }
+      } else {
+        // No @ symbol, this is definitely a protocol
+        url = cleanUpProtocol(potential_protocol);
+
+        if (url === false) {
+          return false;
+        }
+      }
+    } else {
+      // Starts with '//', this is definitely a protocol like http://
+      url = cleanUpProtocol(potential_protocol);
+
+      if (url === false) {
+        return false;
+      }
+    }
   } else if (options.require_protocol) {
     return false;
-  } else if (url.slice(0, 2) === '//') {
-    if (!options.allow_protocol_relative_urls) {
+  }
+
+  // Handle leading '//' only as protocol-relative when there was NO explicit protocol.
+  // If there was an explicit protocol, '//' is the normal separator
+  // and should be stripped unconditionally.
+  if (url.slice(0, 2) === '//') {
+    if (!had_explicit_protocol && !options.allow_protocol_relative_urls) {
       return false;
     }
-    split[0] = url.slice(2);
+
+    url = url.slice(2);
   }
-  url = split.join('://');
 
   if (url === '') {
     return false;
diff --git a/src/lib/isVAT.js b/src/lib/isVAT.js
index 50fcf52e0..1ec2c5991 100644
--- a/src/lib/isVAT.js
+++ b/src/lib/isVAT.js
@@ -60,7 +60,7 @@ export const vatMatchers = {
   DK: str => /^(DK)?\d{8}$/.test(str),
   EE: str => /^(EE)?\d{9}$/.test(str),
   FI: str => /^(FI)?\d{8}$/.test(str),
-  FR: str => /^(FR)?\w{2}\d{9}$/.test(str),
+  FR: str => /^(FR)([A-Z0-9]{2}\d{9})$/.test(str),
   DE: str => /^(DE)?\d{9}$/.test(str),
   EL: str => /^(EL)?\d{9}$/.test(str),
   HU: str => /^(HU)?\d{8}$/.test(str),
diff --git a/test/validators.test.js b/test/validators.test.js
index 7c8c49594..a3c5f5a5d 100644
--- a/test/validators.test.js
+++ b/test/validators.test.js
@@ -424,6 +424,12 @@ describe('Validators', () => {
         'http://[2010:836B:4179::836B:4179]',
         'http://example.com/example.json#/foo/bar',
         'http://1337.com',
+        // TODO: those probably should not be marked as valid URLs; CVE-2025-56200
+        /* eslint-disable no-script-url */
+        'javascript:%61%6c%65%72%74%28%31%29@example.com',
+        'http://evil-site.com@example.com/',
+        'ｊａｖａｓｃｒｉｐｔ:alert(1)@example.com',
+        /* eslint-enable no-script-url */
       ],
       invalid: [
         'http://localhost:3000/',
@@ -466,6 +472,18 @@ describe('Validators', () => {
         '////foobar.com',
         'http:////foobar.com',
         'https://example.com/foo/<script>alert(\'XSS\')</script>/',
+        // the following tests are because of CVE-2025-56200
+        /* eslint-disable no-script-url */
+        "javascript:alert(1);a=';@example.com/alert(1)'",
+        'JaVaScRiPt:alert(1)@example.com',
+        'javascript:/* comment */alert(1)@example.com',
+        'javascript:var a=1; alert(a);@example.com',
+        'javascript:alert(1)@user@example.com',
+        'javascript:alert(1)@example.com?q=safe',
+        'data:text/html,<script>alert(1)</script>@example.com',
+        'vbscript:msgbox("XSS")@example.com',
+        '//evil-site.com/path@example.com',
+        /* eslint-enable no-script-url */
       ],
     });
   });
@@ -478,9 +496,11 @@ describe('Validators', () => {
       }],
       valid: [
         'rtmp://foobar.com',
+        'rtmp:foobar.com',
       ],
       invalid: [
         'http://foobar.com',
+        'tel:+15551234567',
       ],
     });
   });
@@ -533,6 +553,9 @@ describe('Validators', () => {
         'rtmp://foobar.com',
         'http://foobar.com',
         'test://foobar.com',
+        // Dangerous! This allows to mark malicious URLs as a valid URL (CVE-2025-56200)
+        // eslint-disable-next-line no-script-url
+        'javascript:alert(1);@example.com',
       ],
       invalid: [
         'mailto:test@example.com',
@@ -704,6 +727,61 @@ describe('Validators', () => {
     });
   });
 
+  it('should validate authentication strings if a protocol is not required', () => {
+    test({
+      validator: 'isURL',
+      args: [{
+        require_protocol: false,
+      }],
+      valid: [
+        'user:pw@foobar.com/',
+      ],
+      invalid: [
+        'user:pw,@foobar.com/',
+      ],
+    });
+  });
+
+  it('should reject authentication strings if a protocol is required', () => {
+    test({
+      validator: 'isURL',
+      args: [{
+        require_protocol: true,
+      }],
+      valid: [
+        'http://user:pw@foobar.com/',
+        'https://user:password@example.com',
+        'ftp://admin:pass@ftp.example.com/',
+      ],
+      invalid: [
+        'user:pw@foobar.com/',
+        'user:password@example.com',
+        'admin:pass@ftp.example.com/',
+      ],
+    });
+  });
+
+  it('should reject invalid protocols when require_valid_protocol is enabled', () => {
+    test({
+      validator: 'isURL',
+      args: [{
+        require_valid_protocol: true,
+        protocols: ['http', 'https', 'ftp'],
+      }],
+      valid: [
+        'http://example.com',
+        'https://example.com',
+        'ftp://example.com',
+      ],
+      invalid: [
+        // eslint-disable-next-line no-script-url
+        'javascript:alert(1);@example.com',
+        'data:text/html,<script>alert(1)</script>@example.com',
+        'file:///etc/passwd@example.com',
+      ],
+    });
+  });
+
   it('should let users specify a host whitelist', () => {
     test({
       validator: 'isURL',
@@ -782,6 +860,24 @@ describe('Validators', () => {
     });
   });
 
+  it('GHSA-9965-vmph-33xx vulnerability - protocol delimiter parsing difference', () => {
+    const DOMAIN_WHITELIST = ['example.com'];
+
+    test({
+      validator: 'isURL',
+      args: [{
+        protocols: ['https'],
+        host_whitelist: DOMAIN_WHITELIST,
+        require_host: false,
+      }],
+      valid: [],
+      invalid: [
+        // eslint-disable-next-line no-script-url
+        "javascript:alert(1);a=';@example.com/alert(1)",
+      ],
+    });
+  });
+
   it('should allow rejecting urls containing authentication information', () => {
     test({
       validator: 'isURL',
@@ -1902,6 +1998,100 @@ describe('Validators', () => {
     });
   });
 
+  it('should validate Tamil alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['ta-IN'],
+      valid: [
+        'அஆஇஈஉஊஎஏஐஒஓஔகஙசஞடணதநபமயரலவழளறனஶஜஷஸஹ',
+        'தமிழ்',
+      ],
+      invalid: [
+        'தமிழ்123',
+        'தமிழ் ',
+        'தமிழ்.',
+        'abc',
+        '',
+      ],
+    });
+  });
+  it('should validate Telugu alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['te-IN'],
+      valid: [
+        'అఆఇఈఉఊఋఌఎఏఐఒఓఔకఖగఘఙచఛజఝఞటఠడఢణతథదధనపఫబభమయరలవశషసహ',
+        'తెలుగు',
+      ],
+      invalid: ['తెలుగు123', 'తెలుగు.', 'abc', ''],
+    });
+  });
+  it('should validate Kannada alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['kn-IN'],
+      valid: [
+        'ಅಆಇಈಉಊಋಎಏಐಒಓಔಕಖಗಘಙಚಛಜಝಞಟಠಡಢಣತಥದಧನಪಫಬಭಮಯರಲವಶಷಸಹಳ',
+        'ಕನ್ನಡ',
+      ],
+      invalid: ['ಕನ್ನಡ123', 'ಕನ್ನಡ.', 'abc', ''],
+    });
+  });
+  it('should validate Malayalam alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['ml-IN'],
+      valid: [
+        'അആഇഈഉഊഋഎഏഐഒഓഔകഖഗഘങചഛജഝഞടഠഡഢണതഥദധനപഫബഭമയരലവശഷസഹള',
+        'മലയാളം',
+      ],
+      invalid: ['മലയാളം123', 'മലയാളം.', 'abc', ''],
+    });
+  });
+  it('should validate Gujarati alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['gu-IN'],
+      valid: [
+        'અઆઇઈઉઊઋએઐઓઔકખગઘચછજઝટઠડઢણતથદધનપફબભમયરલવશષસહળ',
+        'ગુજરાતી',
+      ],
+      invalid: ['ગુજરાતી123', 'ગુજરાતી.', 'abc', ''],
+    });
+  });
+  it('should validate Punjabi alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['pa-IN'],
+      valid: [
+        'ਅਆਇਈਉਊਏਐਓਔਕਖਗਘਙਚਛਜਝਞਟਠਡਢਣਤਥਦਧਨਪਫਬਭਮਯਰਲਵਸ਼ਸਹ',
+        'ਪੰਜਾਬੀ',
+      ],
+      invalid: ['ਪੰਜਾਬੀ123', 'ਪੰਜਾਬੀ.', 'abc', ''],
+    });
+  });
+  it('should validate Odia alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['or-IN'],
+      valid: [
+        'ଅଆଇଈଉଊଋଌଏଐଓଔକଖଗଘଙଚଛଜଝଞଟଠଡଢଣତଥଦଧନପଫବଭମଯରଲଶଷସହଳ',
+        'ଓଡ଼ିଆ',
+      ],
+      invalid: ['ଓଡ଼ିଆ123', 'ଓଡ଼ିଆ.', 'abc', ''],
+    });
+  });
+  it('should validate Bengali alpha strings', () => {
+    test({
+      validator: 'isAlpha',
+      args: ['bn-IN'],
+      valid: [
+        'অআইঈউঊঋএঐওঔকখগঘঙচছজঝঞটঠডঢণতথদধনপফবভমযরলশষসহ',
+        'বাংলা',
+      ],
+      invalid: ['বাংলা123', 'বাংলা.', 'abc', ''],
+    });
+  });
   it('should validate persian alpha strings', () => {
     test({
       validator: 'isAlpha',
@@ -2699,6 +2889,164 @@ describe('Validators', () => {
       ],
     });
   });
+  it('should validate Tamil alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['ta-IN'],
+      valid: [
+        'தமிழ்',
+        'தமிழ்123',
+        'அஆஇஈ123',
+        'தமிழ்123.45',
+        '123.45',
+        'தமிழ்.',
+      ],
+      invalid: [
+        'தமிழ் ',
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Telugu alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['te-IN'],
+      valid: [
+        'తెలుగు',
+        'తెలుగు123',
+        'అఆఇఈ123',
+        'తెలుగు123.45',
+        '123.45',
+        'తెలుగు.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Kannada alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['kn-IN'],
+      valid: [
+        'ಕನ್ನಡ',
+        'ಕನ್ನಡ123',
+        'ಅಆಇಈ123',
+        'ಕನ್ನಡ123.45',
+        '123.45',
+        'ಕನ್ನಡ.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Malayalam alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['ml-IN'],
+      valid: [
+        'മലയാളം',
+        'മലയാളം123',
+        'അആഇഈ123',
+        'മലയാളം123.45',
+        '123.45',
+        'മലയാളം.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Gujarati alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['gu-IN'],
+      valid: [
+        'ગુજરાતી',
+        'ગુજરાતી123',
+        'અઆઇઈ123',
+        'ગુજરાતી123.45',
+        '123.45',
+        'ગુજરાતી.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Punjabi alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['pa-IN'],
+      valid: [
+        'ਪੰਜਾਬੀ',
+        'ਪੰਜਾਬੀ123',
+        'ਅਆਇਈ123',
+        'ਪੰਜਾਬੀ123.45',
+        '123.45',
+        'ਪੰਜਾਬੀ.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Odia alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['or-IN'],
+      valid: [
+        'ଓଡ଼ିଆ',
+        'ଓଡ଼ିଆ123',
+        'ଅଆଇଈ123',
+        'ଓଡ଼ିଆ123.45',
+        '123.45',
+        'ଓଡ଼ିଆ.',
+      ],
+      invalid: [
+        'abc',
+        '',
+      ],
+    });
+  });
+
+  it('should validate Bengali alphanumeric strings', () => {
+    test({
+      validator: 'isAlphanumeric',
+      args: ['bn-IN'],
+      valid: [
+        'বাংলা',
+        'বাংলা১২৩',
+        'অআইঈ১২৩',
+        '১২৩৪৫৬৭৮৯০',
+        'বাংলা১২৩',
+        '১২৩৪৫',
+        'বাংলা',
+      ],
+      invalid: [
+        'abc',
+        'বাংলা123',
+        '123',
+        'বাংলা ১২৩',
+        'বাংলা,১২৩',
+        '১২৩٫৪৫',
+        '',
+      ],
+    });
+  });
 
   it('should error on invalid locale', () => {
     test({
@@ -7871,7 +8219,7 @@ describe('Validators', () => {
         ],
       },
       {
-        local: 'en-LS',
+        locale: 'en-LS',
         valid: [
           '+26622123456',
           '+26628123456',
@@ -10688,6 +11036,11 @@ describe('Validators', () => {
           '80912345',
         ],
       },
+      {
+        locale: 'ar-QA',
+        valid: ['+97435551234', '+97455551234', '+97465551234', '+97475551234', '35551234', '55551234', '65551234', '75551234'],
+        invalid: ['+97445551234', '+97405551234', '+9745555123', '+974555512345', '+97355551234', '+9125551234', '25551234', '+13005551234', '45551234', '95551234', '+9745555abcd', '', '+974'],
+      },
     ];
 
     let allValid = [];
@@ -14798,11 +15151,18 @@ describe('Validators', () => {
       args: ['FR'],
       valid: [
         'FRAA123456789',
-        'AA123456789',
+        'FR83404833048',
+        'FR40123456789',
+        'FRA1123456789',
+        'FR1A123456789',
       ],
       invalid: [
         'FR AA123456789',
         '123456789',
+        'FRAA123456789A',
+        'FR123456789',
+        'FR 83404833048',
+        'FRaa123456789',
       ],
     });
     test({