JSON Security Vulnerabilities: Complete Protection Guide 2026

# JSON Security Vulnerabilities: Complete Protection Guide 2026

JSON is everywhere in modern applications, but with great ubiquity comes significant security responsibility. From prototype pollution to injection attacks, JSON processing introduces vulnerabilities that can compromise entire systems.

This guide covers every major JSON security vulnerability and provides actionable defenses for production applications.

Table of Contents

---

Injection Attacks

JSON Injection Basics

JSON injection occurs when untrusted data is embedded into JSON responses without proper encoding, allowing attackers to inject malicious payloads.

// ❌ DANGEROUS: Direct string interpolation
app.get('/api/user', (req, res) => {
  const username = req.query.username;

  const json = {

    "user": "${username}",
    "role": "guest"
  };

  res.send(json);
});

// Attack: ?username=admin","role":"superadmin","x":"
// Results in:
{
  "user": "admin",
  "role": "superadmin",
  "x": "",
  "role": "guest"
}

// ✅ SAFE: Use JSON.stringify()
app.get('/api/user', (req, res) => {
  const username = req.query.username;

  const data = {
    user: username,
    role: 'guest'
  };

  res.json(data); // Express automatically uses JSON.stringify()
});

SQL Injection via JSON

When JSON data is used in SQL queries without sanitization:

// ❌ VULNERABLE
app.post('/api/search', (req, res) => {
  const { searchTerm } = req.body;

  const query = SELECT  FROM products WHERE name = '${searchTerm}';

  db.query(query, (err, results) => {
    res.json(results);
  });
});

// Attack payload:
{
  "searchTerm": "'; DROP TABLE products; --"
}

// ✅ SAFE: Parameterized queries
app.post('/api/search', (req, res) => {
  const { searchTerm } = req.body;

  db.query(
    'SELECT  FROM products WHERE name = ?',
    [searchTerm],
    (err, results) => {
      res.json(results);
    }
  );
});

---

Prototype Pollution

Understanding the Attack

JavaScript's prototype chain can be manipulated through JSON parsing, allowing attackers to inject properties into Object.prototype, affecting all objects.

function merge(target, source) {
  for (let key in source) {
    target[key] = source[key];
  }
  return target;
}

// Attacker sends:
{
  "__proto__": {
    "isAdmin": true
  }
}

const userPrefs = {};
merge(userPrefs, req.body);

// Now ALL objects have isAdmin = true!
const user = {};
console.log(user.isAdmin); // true (DANGEROUS!)

// Authentication bypass
function checkAdmin(user) {
  if (user.isAdmin) {
    return grantAccess();
  }
  return denyAccess();
}

// After pollution, all users are admins!

Protection Strategies

// ✅ Create objects without prototype
const safeObject = Object.create(null);
safeObject.__proto__ = 'attack'; // Just a regular property, not pollution

function safeMerge(target, source) {
  const dangerousKeys = ['__proto__', 'constructor', 'prototype'];

  for (let key in source) {
    if (dangerousKeys.includes(key)) {
      continue; // Skip dangerous keys
    }

    if (source.hasOwnProperty(key)) {
      target[key] = source[key];
    }
  }

  return target;
}

// lodash v4.17.21+ has prototype pollution fixes
const _ = require('lodash');
const safe = _.merge({}, req.body); // Protected merge

// Prevent prototype modification
Object.freeze(Object.prototype);
Object.freeze(Array.prototype);

---

Denial of Service (DoS)

Deep Object Nesting Attack

Extremely nested JSON can exhaust parser stack depth:

// Attack: 10,000 levels of nesting
{
  "a": {
    "a": {
      "a": {
        // ... 10,000 more levels
      }
    }
  }
}

function limitDepth(obj, maxDepth = 10, currentDepth = 0) {
  if (currentDepth > maxDepth) {
    throw new Error('Maximum nesting depth exceeded');
  }

  for (let key in obj) {
    if (typeof obj[key] === 'object' && obj[key] !== null) {
      limitDepth(obj[key], maxDepth, currentDepth + 1);
    }
  }
}

// Usage
app.use(express.json({
  verify: (req, res, buf) => {
    const json = JSON.parse(buf);
    limitDepth(json);
  }
}));

Large Payload Attack

Massive JSON payloads consume memory and CPU:

// Attack: 1GB JSON payload
{
  "items": [
    // 10 million array items
  ]
}

// Express middleware
app.use(express.json({
  limit: '1mb' // Reject payloads over 1MB
}));

// Custom middleware
app.use((req, res, next) => {
  const contentLength = parseInt(req.headers['content-length'] || '0');

  if (contentLength > 1048576) { // 1MB
    return res.status(413).json({
      error: 'Payload too large',
      maxSize: '1MB',
      received: ${(contentLength / 1048576).toFixed(2)}MB
    });
  }

  next();
});

Hash Collision DoS

Attackers craft keys to cause hash collisions, degrading object access to O(n):

// Attack: Many keys with same hash
{
  "k1": 1,
  "k2": 2,
  // ... 100,000 keys with colliding hashes
}

function limitKeys(obj, maxKeys = 1000) {
  const keyCount = Object.keys(obj).length;

  if (keyCount > maxKeys) {
    throw new Error(Too many keys (max: ${maxKeys}, got: ${keyCount}));
  }

  // Recursively check nested objects
  for (let key in obj) {
    if (typeof obj[key] === 'object' && obj[key] !== null) {
      limitKeys(obj[key], maxKeys);
    }
  }
}

---

Mass Assignment Vulnerabilities

The Problem

Accepting all JSON fields allows attackers to set unauthorized properties:

// User model
{
  username: String,
  email: String,
  role: String,      // Should not be user-settable!
  isVerified: Boolean // Should not be user-settable!
}

// ❌ VULNERABLE: Accept all fields
app.post('/api/users', (req, res) => {
  const user = new User(req.body);
  await user.save();
});

// Attack: Set yourself as admin
{
  "username": "attacker",
  "email": "attacker@evil.com",
  "role": "admin",
  "isVerified": true
}

Solution: Whitelist Fields

// ✅ SAFE: Only accept allowed fields
app.post('/api/users', (req, res) => {
  const allowedFields = ['username', 'email', 'password'];

  const userData = {};
  for (let field of allowedFields) {
    if (req.body[field] !== undefined) {
      userData[field] = req.body[field];
    }
  }

  const user = new User(userData);
  user.role = 'user'; // Set safe defaults
  user.isVerified = false;

  await user.save();
  res.json(user);
});

Using Libraries

// Express Validator
const { body, validationResult } = require('express-validator');

app.post('/api/users',
  body('username').isAlphanumeric().isLength({ min: 3, max: 20 }),
  body('email').isEmail(),
  body('password').isLength({ min: 8 }),
  async (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }

    // Only validated fields are processed
    const { username, email, password } = req.body;
    // role and isVerified are ignored
  }
);

---

Information Disclosure

Exposing Sensitive Data

// ❌ BAD: Sending entire user object
app.get('/api/users/:id', async (req, res) => {
  const user = await User.findById(req.params.id);
  res.json(user); // Includes password hash, tokens, etc.!
});

// Response includes sensitive fields:
{
  "id": 123,
  "username": "john",
  "email": "john@example.com",
  "passwordHash": "$2b$10$...",  // LEAKED!
  "resetToken": "secret123",      // LEAKED!
  "ssn": "123-45-6789"            // LEAKED!
}

// ✅ GOOD: Select only safe fields
app.get('/api/users/:id', async (req, res) => {
  const user = await User.findById(req.params.id)
    .select('id username email avatar');

  res.json(user);
});

// Safe response:
{
  "id": 123,
  "username": "john",
  "email": "john@example.com",
  "avatar": "https://..."
}

Error Message Leakage

// ❌ DANGEROUS: Exposing internal errors
app.post('/api/login', async (req, res) => {
  try {
    const user = await User.findOne({ email: req.body.email });
    if (!user) {
      return res.status(404).json({
        error: 'User not found in database table users_v2'
      }); // Reveals database structure!
    }
  } catch (error) {
    res.status(500).json({
      error: error.message, // Reveals stack traces!
      stack: error.stack
    });
  }
});

// ✅ SAFE: Generic error messages
app.post('/api/login', async (req, res) => {
  try {
    const user = await User.findOne({ email: req.body.email });
    if (!user) {
      return res.status(401).json({
        error: 'Invalid credentials'
      }); // Generic message
    }
  } catch (error) {
    logger.error(error); // Log internally only
    res.status(500).json({
      error: 'An error occurred'
    });
  }
});

---

Schema Validation Bypass

Insufficient Validation

// ❌ WEAK: Only checks if fields exist
function validateUser(data) {
  return data.username && data.email;
}

// Bypass: Send unexpected data types
{
  "username": ["array"],     // Should be string!
  "email": 123,              // Should be string!
  "admin": true              // Extra field!
}

const Ajv = require('ajv');
const ajv = new Ajv({ allErrors: true });

const userSchema = {
  type: 'object',
  properties: {
    username: { type: 'string', minLength: 3, maxLength: 20 },
    email: { type: 'string', format: 'email' },
    age: { type: 'integer', minimum: 0, maximum: 150 }
  },
  required: ['username', 'email'],
  additionalProperties: false // Reject unknown fields
};

const validate = ajv.compile(userSchema);

app.post('/api/users', (req, res) => {
  if (!validate(req.body)) {
    return res.status(400).json({
      errors: validate.errors
    });
  }

  // Data is guaranteed to match schema
  createUser(req.body);
});

---

Security Best Practices

1. Never Trust Client Input

// ✅ Validate everything
app.post('/api/data', [
  body('').escape(), // Sanitize all fields

  body('amount').isFloat({ min: 0, max: 1000000 }),
  body('email').isEmail().normalizeEmail(),
], handler);

app.use((req, res, next) => {
  if (req.method === 'POST' && !req.is('application/json')) {
    return res.status(415).json({
      error: 'Content-Type must be application/json'
    });
  }
  next();
});

const rateLimit = require('express-rate-limit');

const apiLimiter = rateLimit({
  windowMs: 15  60  1000, // 15 minutes

  max: 100, // Limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP'
});

app.use('/api/', apiLimiter);

const cors = require('cors');

// ✅ GOOD: Whitelist specific origins
app.use(cors({
  origin: ['https://trusted-domain.com'],
  credentials: true
}));

// ❌ BAD: Allow all origins
app.use(cors({ origin: '' }));

5. Log and Monitor

const winston = require('winston');

app.use((req, res, next) => {
  // Log suspicious patterns
  if (req.body && JSON.stringify(req.body).includes('__proto__')) {
    winston.warn('Prototype pollution attempt', {
      ip: req.ip,
      body: req.body
    });
  }
  next();
});

---

Security Checklist

✅ Input Validation:

• Use JSON Schema validation
• Whitelist allowed fields
• Validate data types and ranges
• Reject additional properties

✅ Injection Prevention:

• Never concatenate JSON strings
• Use parameterized queries
• Sanitize user input
• Escape special characters

✅ DoS Protection:

• Limit payload size (1-10MB)
• Limit nesting depth (5-10 levels)
• Limit array/object keys (1000 max)
• Implement request timeouts

✅ Prototype Pollution:

• Validate object keys
• Avoid recursive merge
• Use Object.create(null)
• Freeze prototypes in critical apps

✅ Information Security:

• Never expose passwords/tokens
• Use field whitelisting
• Generic error messages
• Sanitize error responses

✅ Infrastructure:

• Use HTTPS only
• Enable rate limiting
• Implement CORS properly
• Monitor for attacks

---

Conclusion

JSON security is not optional in 2026. With APIs handling millions of requests daily, a single vulnerability can compromise entire systems. Implement these defenses:

Security is a continuous process. Audit your code regularly, stay updated on new vulnerabilities, and always assume inputs are malicious until proven otherwise.

Your API's security is your users' security. Treat it accordingly.

Security Tools

• JSON Validator - Validate before processing
• JSON Schema Guide - Implement validation
• JSON Best Practices - Secure coding patterns