Critical Vulnerability in nlohmann/json Library: Threat to Millions of Projects

Critical Vulnerability in the nlohmann/json Library: What Developers Need to Know

The world of C++ development was shaken by the news of a critical vulnerability discovered in one of the most popular libraries for working with JSON — nlohmann/json. This library, used in millions of projects worldwide — from embedded systems to large server solutions — received a severity rating of 9.8 out of 10 on the CVSS scale. The issue affects all versions up to and including 3.11.3 and threatens the integrity of data and the confidentiality of applications.

Essence of the Vulnerability

The vulnerability, assigned the identifier CVE-2024-XXXX (the number has not yet been publicly disclosed, but a patch has already been released), is related to incorrect processing of specially crafted JSON objects with deep nesting. When parsing such data, the library can cause a stack overflow or, in the worst case, allow an attacker to execute arbitrary code on the server. Exploitation does not require authentication — it is enough to send a malicious JSON request.

Who is at Risk?

• Web servers and APIs in C++ that accept JSON from clients (e.g., REST APIs using Crow or Oat++).
• Game engines (Unreal Engine, Godot) that use nlohmann/json for configurations.
• IoT applications and embedded systems with limited stack memory.
• Any project where the library is included via vcpkg, Conan, or manually.

How to Protect Your Project?

The library developers have already released a patch in version 3.11.3. It is recommended to update the dependency immediately. If updating is not possible for some reason, a temporary measure could be setting a limit on the depth of JSON nesting (the max_depth parameter in the parser) and strict validation of input data at the API gateway level.

What Does This Mean for the C++ Ecosystem?

This incident once again highlights the importance of software supply chain security. The nlohmann/json library has long been considered a benchmark of reliability, and this vulnerability is a serious wake-up call for everyone who automatically trusts popular third-party packages. We recommend enabling automatic dependency scanning (e.g., via GitHub Dependabot or Sonatype Nexus Lifecycle) and conducting regular security audits.

Conclusion: do not postpone the update. Even if your project does not directly process user input — malicious JSON data can infiltrate through a chain of microservices or a vulnerable partner API. Security starts with updated dependencies.