diff --git a/doc/api/esm.md b/doc/api/esm.md
index 07a3a71e90f0fd..248619b38008d3 100644
--- a/doc/api/esm.md
+++ b/doc/api/esm.md
@@ -700,6 +700,8 @@ _isMain_ is **true** when resolving the Node.js application entry point.
 >       1. Throw an _Invalid Specifier_ error.
 >    1. Set _packageName_ to the substring of _packageSpecifier_
 >       until the second _"/"_ separator or the end of the string.
+> 1. If _packageName_ starts with _"."_ or contains _"\\"_ or _"%"_, then
+>    1. Throw an _Invalid Specifier_ error.
 > 1. Let _packageSubpath_ be the substring of _packageSpecifier_ from the
 >    position at the length of _packageName_ plus one, if any.
 > 1. Assert: _packageName_ is a valid package name or scoped package name.
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 9f5dfe98e3fa76..9332c6c27793fd 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -336,7 +336,7 @@ function findLongestRegisteredExtension(filename) {
 // This only applies to requests of a specific form:
 // 1. name/.*
 // 2. @scope/name/.*
-const EXPORTS_PATTERN = /^((?:@[^@/\\%][^@/\\%]*\/)?[^@/\\%]+)(\/.*)$/;
+const EXPORTS_PATTERN = /^((?:@[^/\\%]+\/)?[^./\\%][^/\\%]*)(\/.*)$/;
 function resolveExports(nmPath, request, absoluteRequest) {
   // The implementation's behavior is meant to mirror resolution in ESM.
   if (experimentalExports && !absoluteRequest) {
diff --git a/src/module_wrap.cc b/src/module_wrap.cc
index d4b09fa4464211..b3d0c306c91922 100644
--- a/src/module_wrap.cc
+++ b/src/module_wrap.cc
@@ -876,10 +876,12 @@ Maybe<URL> PackageResolve(Environment* env,
     } else {
       sep_index = specifier.find('/', sep_index + 1);
     }
+  } else if (specifier[0] == '.') {
+    valid_package_name = false;
   }
   std::string pkg_name = specifier.substr(0,
       sep_index == std::string::npos ? std::string::npos : sep_index);
-  // Package name can only have leading @, and cannot have percent-encoding or
+  // Package name cannot have leading . and cannot have percent-encoding or
   // separators.
   for (size_t i = 0; i < pkg_name.length(); i++) {
     char c = pkg_name[i];