PT-2026-134800

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=575915982 Crash type: Use-of-uninitialized-value Crash state: nlohmann::json abi v3 12 0::detail::binary readernlohmann::json abi v3 12 0::ba nlohmann::json abi v3 12 0::detail::binary readernlohmann::json abi v3 12 0::ba...

json:parse_bson_fuzzer: Use-of-uninitialized-value in nlohmann::json_abi_v3_12_0::detail::binary_reader<nlohmann::json_abi_v3_12_0::ba

Project: https://github.com/nlohmann/json.git Detailed Report: https://oss-fuzz.com/testcase?key=5520518678380544 Project: json Fuzzing Engine: libFuzzer Fuzz Target: parsebsonfuzzer Job Type: libfuzzermsanjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2026-42355

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive ASAR parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's...

EUVD-2024-34736

Malicious code in bioql PyPI...

Malware in nlohmann-json

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-711 Malicious code in nlohmann-json (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5aa85efabb2331d4495a31e8b8101fb7a0cdd11d7c9a4724b6fbb2a3c60b9296 Any computer that has this package installed or running should be considered...

Malicious code in nlohmann-json (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5aa85efabb2331d4495a31e8b8101fb7a0cdd11d7c9a4724b6fbb2a3c60b9296 Any computer that has this package installed or running should be considered...

Denial Of Service (DoS)

Envoy is vulnerable to Denial Of Service DoS. The vulnerability is due to how Envoy invoked the nlohmann JSON library via source/common/json/jsoninternal.cc, which could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The vulnerability allows an...

CVE-2024-38525

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-38525 dd-trace-cpp malformed unicode header values may cause crash

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-38525 dd-trace-cpp malformed unicode header values may cause crash

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-38525: Improper Input Validation

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-34363

Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash...

CVE-2024-34363

Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash...

PT-2024-25821 · Unknown +1 · Nlohmann/Json +1

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue arises from how Envoy invokes the nlohmann JSON library. If incomplete UTF-8 strings are serialized from downstream data, the library can throw an uncaught exception, causing Envoy ...

CVE-2024-34363: Uncaught Exception

Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash...

PT-2022-37000

Name of the Vulnerable Software and Affected Versions nlohmann/json affected versions not specified Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This can lead to a crash or potentially allow a...

json:parse_bjdata_fuzzer: Heap-use-after-free in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

Project: https://github.com/nlohmann/json.git Detailed Report: https://oss-fuzz.com/testcase?key=5655231259607040 Project: json Fuzzing Engine: libFuzzer Fuzz Target: parsebjdatafuzzer Job Type: libfuzzerasanjson Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address:...

PT-2022-36987

Name of the Vulnerable Software and Affected Versions nlohmann/json affected versions not specified Description A heap buffer overflow read issue has been identified. The crash type is Heap-buffer-overflow READ 1. The crash state involves std:: 1:: tree node base and std:: 1:: tree. Technical...

json:parse_bjdata_fuzzer: Heap-buffer-overflow in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

Project: https://github.com/nlohmann/json.git Detailed Report: https://oss-fuzz.com/testcase?key=5698044521218048 Project: json Fuzzing Engine: libFuzzer Fuzz Target: parsebjdatafuzzer Job Type: libfuzzerasanjson Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...