All pull requests

Pull requests

• honor case_sensitive in detach_path for object members

  #1121·nabhan06 opened Oct 27, 2026·

  ·

• utils: fix decode_pointer_inplace dropping bytes after escapes (CVE-2026-29036)

  #1120·w4ffl35 opened Oct 27, 2026·

  ·

• tests: regression test for object-patch-subtree-of-array merge_patch UAF (companion to #1109)

  #1119·w4ffl35 opened Oct 27, 2026·

  ·

• fuzzing: add a fuzzer for cJSON_Utils

  #1118·0xalpharush opened Oct 27, 2026·

  ·

• Guard print_string_ptr counters against 32-bit overflow (CVE-2026-16554)

  #1117·w4ffl35 opened Oct 26, 2026·

  ·

• Bound cJSON_Compare cost: sort-based objects, depth cap (CVE-2026-67216)

  #1116·w4ffl35 opened Oct 26, 2026·

  ·

• Cap JSON Patch graft depth at the nesting limit (CVE-2026-67215)

  #1115·w4ffl35 opened Oct 26, 2026·

  ·

• Apply JSON Patch arrays atomically (CVE-2026-67217)

  #1114·w4ffl35 opened Oct 26, 2026·

  ·

• cJSON_ReplaceItemViaPointer: reject items with NULL prev to prevent list corruption

  #1113·akashdeshmukh-git opened Oct 23, 2026·

  ·

• cmake: use relative install destinations for relocatable package exports

  #1112·akashdeshmukh-git opened Oct 23, 2026·

  ·
  1

• handle multi-byte locale decimal points in parse_number and print_number

  #1111·nabhan06 opened Oct 21, 2026·

  ·

• Fix: compare_double mishandles infinities (#1071)

  #1110·zhouyunding opened Oct 20, 2026·

  ·
  1

  1

• Fix: heap-use-after-free in merge_patch when target is not an object and contains patch (Variant of what #1060 fixed)

  #1109·Oculytic opened Oct 19, 2026·

  ·
  3

• reject numbers that are not valid JSON in parse_number

  #1108·nabhan06 opened Oct 18, 2026·

  ·

• Fix NaN conversion in cJSON_SetNumberHelper

  #1107·Yash-Petkar opened Oct 17, 2026·

  ·

• reject invalid hex digits in \u escapes

  #1105·nabhan06 opened Oct 16, 2026·

  ·
  1

• docs: name the object reference API in Objects

  #1104·dajiaohuang opened Oct 16, 2026·

  ·

• reject overflowing array index in decode_array_index_from_pointer

  #1103·nabhan06 opened Oct 15, 2026·

  ·

• cJSON_Utils: survive allocation failures in the patch/merge/pointer helpers

  #1102·bg0d-droid opened Oct 15, 2026·

  ·

• fix escaped backslash handling in minify_string

  #1101·nabhan06 opened Oct 14, 2026·

  ·

• Fix exact double recovery when printing numbers

  #1099·sergioperezcheco opened Oct 11, 2026·

  ·
  1

• fix ~0/~1 unescaping in decode_pointer_inplace

  #1098·nabhan06 opened Oct 8, 2026·

  ·
  1

• Link the dual-build static library with libm

  #1097·fhgffy opened Oct 5, 2026·

  ·

• Fix: correct __GNUCC__ typo in cJSON_Utils.c

  #1096·Fojdjebu opened Oct 5, 2026·

  ·
  1

• Fix Heap-Use-After-Free in cJSONUtils_MergePatch via Recursive Deletion

  #1092·PGZXB opened Sep 24, 2026·

  ·
  1