All pull requests

Pull requests

• cjson: Add new fuzzer/corpus/dict targets input utils

  #1126·arthurscchan opened Nov 4, 2026·

  ·

• OSS-Fuzz: Add new fuzzer/corpus/dict targets builder process

  #1125·arthurscchan opened Nov 4, 2026·

  ·

• OSS-Fuzz: Add corpus generation and dict for json fuzzer

  #1124·arthurscchan opened Nov 4, 2026·

  ·

• cJSON: avoid undefined behavior when assigning NaN to valueint

  #1123·akashdeshmukh-git opened Nov 3, 2026·

  ·
  1

• honor case_sensitive in detach_path for object members

  #1121·nabhan06 opened Oct 27, 2026·

  ·

• utils: fix decode_pointer_inplace dropping bytes after escapes (CVE-2026-29036)

  #1120·w4ffl35 opened Oct 27, 2026·

  ·

• tests: regression test for object-patch-subtree-of-array merge_patch UAF (companion to #1109)

  #1119·w4ffl35 opened Oct 27, 2026·

  ·

• fuzzing: add a fuzzer for cJSON_Utils

  #1118·0xalpharush opened Oct 27, 2026·

  ·

• Guard print_string_ptr counters against 32-bit overflow (CVE-2026-16554)

  #1117·w4ffl35 opened Oct 26, 2026·

  ·

• Bound cJSON_Compare cost: sort-based objects, depth cap (CVE-2026-67216)

  #1116·w4ffl35 opened Oct 26, 2026·

  ·

• Cap JSON Patch graft depth at the nesting limit (CVE-2026-67215)

  #1115·w4ffl35 opened Oct 26, 2026·

  ·

• Apply JSON Patch arrays atomically (CVE-2026-67217)

  #1114·w4ffl35 opened Oct 26, 2026·

  ·

• cJSON_ReplaceItemViaPointer: reject items with NULL prev to prevent list corruption

  #1113·akashdeshmukh-git opened Oct 23, 2026·

  ·

• cmake: use relative install destinations for relocatable package exports

  #1112·akashdeshmukh-git opened Oct 23, 2026·

  ·
  1

• handle multi-byte locale decimal points in parse_number and print_number

  #1111·nabhan06 opened Oct 21, 2026·

  ·

• Fix: compare_double mishandles infinities (#1071)

  #1110·zhouyunding opened Oct 20, 2026·

  ·
  1

  1

• Fix: heap-use-after-free in merge_patch when target is not an object and contains patch (Variant of what #1060 fixed)

  #1109·Oculytic opened Oct 19, 2026·

  ·
  3

• reject numbers that are not valid JSON in parse_number

  #1108·nabhan06 opened Oct 18, 2026·

  ·

• Fix NaN conversion in cJSON_SetNumberHelper

  #1107·Yash-Petkar opened Oct 17, 2026·

  ·

• reject invalid hex digits in \u escapes

  #1105·nabhan06 opened Oct 16, 2026·

  ·
  1

• docs: name the object reference API in Objects

  #1104·dajiaohuang opened Oct 16, 2026·

  ·

• reject overflowing array index in decode_array_index_from_pointer

  #1103·nabhan06 opened Oct 15, 2026·

  ·

• cJSON_Utils: survive allocation failures in the patch/merge/pointer helpers

  #1102·bg0d-droid opened Oct 15, 2026·

  ·

• fix escaped backslash handling in minify_string

  #1101·nabhan06 opened Oct 14, 2026·

  ·

• Fix exact double recovery when printing numbers

  #1099·sergioperezcheco opened Oct 11, 2026·

  ·
  1