Security vulnerabilities and automated fixes for json parsing issues
6 posts found
A critical prototype pollution vulnerability was discovered in `worker/import-core.js`, where `request.json()` parsed untrusted HTTP request bodies without filtering dangerous keys like `__proto__` and `constructor`. An attacker could send a crafted JSON payload to corrupt the global `Object` prototype, potentially affecting every object in the application runtime. The fix replaces the unsafe parse with a JSON reviver function that strips these dangerous keys before any object is constructed.
CVE-2026-32285 is a high-severity Denial of Service vulnerability in the Go library `github.com/buger/jsonparser` v1.1.1, triggered by crafted malformed JSON input. The fix is a dependency upgrade to v1.1.2 in `go.mod` and `go.sum`, which tightens input handling without affecting valid JSON processing. Any Go application that parses untrusted JSON through this library is potentially exposed until the upgrade is applied.
A Denial of Service vulnerability (CVE-2026-32285) was discovered in the `github.com/buger/jsonparser` dependency used by this Go application, where crafted malformed JSON input could cause the parser to crash or hang, potentially taking down any service that processes untrusted JSON. The fix upgrades the dependency from v1.1.1 to v1.1.2 in `go.mod` and `go.sum`, closing the attack vector without changing any valid-input behavior. This is a practical reminder that transitive dependencies carry r
A high-severity denial of service vulnerability (CVE-2025-67221) was discovered in orjson 3.10.16, where deeply nested JSON documents could trigger unbounded recursion and crash the application. The fix upgrades orjson to version 3.11.6, which implements recursion depth limits to prevent stack exhaustion attacks.
A critical buffer overflow vulnerability was discovered and patched in the popular OJ Ruby JSON library's fast.c parser, where an unbounded strcpy call allowed attacker-controlled JSON input to overwrite adjacent memory. Left unpatched, this classic CWE-120 flaw could enable arbitrary code execution in any application parsing untrusted JSON with the affected library. The fix eliminates the unsafe copy operation, closing a potential remote code execution vector that affected countless Ruby applic
A medium-severity vulnerability in file import functionality left applications vulnerable to Denial of Service (DoS) attacks through maliciously crafted files. By exploiting missing resource limits and validation checks, attackers could exhaust server memory with deeply nested JSON or oversized files, potentially bringing down entire services.