JSON Debugging

JSON Depth Limit Security Guide

Set JSON nesting, size and collection limits to protect parsers and application logic from stack, memory and CPU exhaustion. Last updated September 30, 2026.

Set JSON nesting, size and collection limits to protect parsers and application logic from stack, memory and CPU exhaustion. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.

Recommended workflow

Step	Why it matters
Map the parser boundary	Identify every gateway, framework and service that parses untrusted JSON.
Define multiple limits	Depth alone does not bound huge arrays, keys, strings or total bytes.
Reject early	Apply transport and streaming limits before building a complete in-memory object.
Return a stable error	Use a documented client error without echoing the hostile payload.

Starter snippet

limits = bytes + nesting depth + object members + array items + string length

Review checks

Test deeply nested near-limits.
Align proxy and application body limits.
Measure parser failure behavior.
Log only safe size and depth metadata.

Common mistakes

Using request body size as the only guard.
Recursively walking untrusted objects without depth control.
Returning parser stack traces to clients.

Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.

Related Formalint references

Continue with Api Request Body Validation Guide, Json Schema Guide, Secrets Redaction Checklist.