Go 1.27 ships stable encoding/json/v2 API
Original: A new Go API for JSON
Why This Matters
Fixes silent data corruption and security flaws baked into Go's core JSON library for 15+ years.
Go 1.27 releases encoding/json/v2 and encoding/json/jsontext as stable packages, fixing long-standing flaws in the original encoding/json—including silent UTF-8 corruption and duplicate key vulnerabilities like CVE-2017-12635.
After more than 15 years, Go's standard library JSON support is getting a major overhaul. The new encoding/json/v2 and encoding/json/jsontext packages ship as stable, generally available APIs in Go 1.27, authored by a team including Joe Tsai, Daniel Martí, and Damien Neil.
The original encoding/json has served well, but accumulated serious behavioral problems over time. It silently accepted invalid UTF-8—violating RFC 8259—potentially corrupting data downstream without any error signal. It also accepted objects with duplicate member names, an ambiguity that RFC 8259 leaves undefined and that has been actively exploited: CVE-2017-12635 leveraged exactly this flaw.
The v2 API tightens all of this up. Invalid UTF-8 now returns an error. Duplicate keys are handled with a defined default behavior. The new jsontext package gives developers lower-level access to JSON token streams, enabling more precise control over encoding and decoding.
This release follows an experimental phase that began in 2025, during which the Go team gathered user feedback and refined the API. The team's blog post—an updated version of the original experimental announcement—documents the full problem set and the design rationale behind v2.