CVE-2026-129114 · Package
NO FIX YET · SEE WHAT TO DO
JSON::XS, a Perl module for encoding and decoding JSON, writes one NUL byte past a heap buffer when incremental parsing appends a one-byte chunk. A peer that controls how its JSON is split into reads can use this to corrupt memory in the consuming process.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only Perl code that uses JSON::XS in incremental mode (incr_parse) on data from a peer that controls how the input is split into reads is exposed. Applications that only decode complete JSON strings in one call, or that do not use JSON::XS at all, can skip it.
Not affected if not-incremental-parsing, versions-outside-range
Who cares json-xs, perl
perl -MJSON::XS -e 'print $JSON::XS::VERSION' and compare the output against the affected range 3.04 to before 4.05.JSON::XS and any Perl application that calls incr_parse.4.05 or later (fixed version per the affected range before 4.05).JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse.
The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation.
A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.