RAPIDJSON · CVE-2026-124586 · Package
NO FIX YET · SEE WHAT TO DO
Per NVD, RapidJSON 1.1.0 has an out-of-bounds read in GetCachedPowerByIndex (include/rapidjson/internal/diyfp.h) via the decimalPosition argument, reachable remotely through crafted JSON. NVD says the project was told through an issue and has not responded. The latest release is still v1.1.0 and I found no fix. The matching upstream issue was not located.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed RapidJSON 1.1.0 and parse JSON from untrusted sources are exposed. Projects that use a different JSON library, or that only parse trusted local files, are less exposed. The sources say the upstream project was reported the issue but has not responded.
Not affected if other-json-library, trusted-input-only
Who cares c++, json-parsing, rapidjson
No patched release: latest RapidJSON release is v1.1.0 (the affected version); master has later commits but none is known to address this CVE.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.