Magento 2 Checkout Failures Post-Security Update: Unmasking Hidden Address Data Inconsistencies

Crucially, this inconsistent state could exist and even be persisted in the database for both quote addresses and customer addresses, dating back years before the issue became critical. The security hardening did not create this invalid data; it merely exposed it.

The Catalyst: Magento's July 2026 Security Hardening (APSB26-73)

The turning point was a specific Magento security update (APSB26-73, released July 2026) that introduced a significant change to how address validation is applied. Previously, the validateQuoteAddress plugin, responsible for validating quote addresses, was scoped only to REST requests:

This configuration was found in vendor/magento/module-quote/etc/webapi_rest/di.xml. After the security update, this plugin was moved to the global quote DI scope (vendor/magento/module-quote/etc/di.xml). This change meant that address validation became universally applied to additional PHP and checkout flows that call setShippingAddress() or setBillingAddress(), not just REST-specific operations.

As a result, previously "tolerated" inconsistent address data, which might have slipped through less stringent validation paths, suddenly triggered hard failures during checkout. Merchants began seeing errors like "Invalid value "80" for field regionId.", blocking customers from completing their purchases.

Identifying Affected Data: Actionable Insight for Developers and Merchants

The GitHub issue provides invaluable SQL queries to help identify these country-mismatched region IDs within your Magento 2 database. These queries can be run on both quote_address and customer_address_entity tables to audit for inconsistencies.

For Quote Addresses:

SELECT
    qa.address_id,
    qa.quote_id,
    qa.address_type,
    qa.country_id,
    qa.region_id,
    qa.region,
    dcr.country_id AS region_country_id,
    dcr.code,
    dcr.default_name,
    qa.updated_at
FROM quote_address AS qa
INNER JOIN directory_country_region AS dcr
    ON dcr.regi
WHERE qa.region_id IS NOT NULL
  AND qa.country_id IS NOT NULL
  AND qa.country_id <> dcr.country_id
ORDER BY qa.updated_at DESC;

For Customer Addresses:

SELECT
    cae.entity_id,
    cae.country_id,
    cae.region_id,
    cae.region,
    dcr.country_id AS region_country_id,
    dcr.code,
    dcr.default_name,
    cae.updated_at
FROM customer_address_entity AS cae
INNER JOIN directory_country_region AS dcr
    ON dcr.regi
WHERE cae.region_id IS NOT NULL
  AND cae.country_id IS NOT NULL
  AND cae.country_id <> dcr.country_id
ORDER BY cae.updated_at DESC;

Running these queries can reveal the extent of the problem in your store, showing records with combinations like address country = AT and regi> (which is a German region).