Why does my CNPJ validation pass this invalid value?

Do this, my friend. Works perfectly for me:

function validarCNPJ(cnpj) {

    cnpj = cnpj.replace(/[^\d]+/g,'');

    if(cnpj == '') return false;

    if (cnpj.length != 14)
        return false;

    // LINHA 10 - Elimina CNPJs invalidos conhecidos
    if (cnpj == "00000000000000" || 
        cnpj == "11111111111111" || 
        cnpj == "22222222222222" || 
        cnpj == "33333333333333" || 
        cnpj == "44444444444444" || 
        cnpj == "55555555555555" || 
        cnpj == "66666666666666" || 
        cnpj == "77777777777777" || 
        cnpj == "88888888888888" || 
        cnpj == "99999999999999")
        return false; // LINHA 21

    // Valida DVs LINHA 23 -
    tamanho = cnpj.length - 2
    numeros = cnpj.substring(0,tamanho);
    digitos = cnpj.substring(tamanho);
    soma = 0;
    pos = tamanho - 7;
    for (i = tamanho; i >= 1; i--) {
      soma += numeros.charAt(tamanho - i) * pos--;
      if (pos < 2)
            pos = 9;
    }
    resultado = soma % 11 < 2 ? 0 : 11 - soma % 11;
    if (resultado != digitos.charAt(0))
        return false;

    tamanho = tamanho + 1;
    numeros = cnpj.substring(0,tamanho);
    soma = 0;
    pos = tamanho - 7;
    for (i = tamanho; i >= 1; i--) {
      soma += numeros.charAt(tamanho - i) * pos--;
      if (pos < 2)
            pos = 9;
    }
    resultado = soma % 11 < 2 ? 0 : 11 - soma % 11;
    if (resultado != digitos.charAt(1))
          return false; // LINHA 49

    return true; // LINHA 51

}

In cnpj = cnpj.replace(/[^\d]+/g,''); , we delete all the non-numeric characters of the last CNPJ as a parameter, considering that the person who invoked the function may have used a mask in the field.

The if statement in if (cnpj.length != 14)return false; checks if the number of numerals in the string (considering it has already been cleared) equals the correct number - 14.

Lines 10 through 21 check if the string is only formed by equal values. This verification is necessary since if we apply the algorithm of the CNPJ on the number "22.222.222 / 2222-22" in theory the verification digits are correct, even though this is NOT a valid number.

Lines 23 to 49 check the two verifiers, verifying their validity according to the CNPJ algorithm. If not, validation returns false by closing the function.

If the algorithm reaches line 51 we have a valid CNPJ and the value true is returned.

Source: link

Just adding a bit of improvement to the @lollipop response, just below the explanation:

function validarCNPJ(cnpj) {
	
    if(cnpj == '' || cnpj == undefined || cnpj == null) {
        return false;
    }
	
    if (typeof(cnpj) != 'string') {
	cnpj = cnpj.toString();
    }
	
    cnpj = cnpj.replace(/[^\d]+/g,'');
  
    // (Restante ok...)

I tested the function by passing different parameters such as arrays, objects, or numbers. As errors occurred, I decided to slightly increase the initial part of the algorithm in the parameter validation:

I apologize for not being able to comment directly on his response, I use StackOverflow sparingly and my low reputation does not yet allow.

I hope it's useful. Hugs to all!

There is a more compact function to validate CNPJ:

function is_cnpj(c) {
    var b = [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2];

    if ((c = c.replace(/[^\d]/g, "")).length != 14)
        return false;

    if (/0{14}/.test(c))
        return false;

    for (var j = 0; j < 2; ++j) {
        for (var i = 0, n = 0; i < 12 + j; n += c[i] * b[++i - j]);
        if (c[12 + j] != ((n %= 11) < 2) ? 0 : 11 - n)
            return false;
    }

    return true;
};

You can test operation and validation on the link link

Although there is no CNPJ or CPF with all the digits repeated, the official validation logic of the verifier digit of these documents declares them valid.

Note that not only a sequence of zeros will pass but also a sequence of one or two or any number.

The way is, in addition to implementing the official algorithm, also include an if that invalidates the document if all digits are equal.

Some ways to do this:

function todosDigitosSaoIguais(cnpj) {
    var cnpj_arr = cnpj.split("");
    var first = cnpj_arr[0];
    return cnpj_arr.every(function(element) {
        return element === first;
    });
}

Or:

function todosDigitosSaoIguais(cnpj) {
    for(var i = 1; i < cnpj.length; i++)
    {
        if(cnpj[i] !== cnpj[0])
            return false;
    }
    return true;
}