The most common JSON parsing errors stem from treating JSON like loose JavaScript objects. The top causes are: 1) Trailing commas at the end of objects or arrays (RFC 8259 strictly forbids commas before closing braces or brackets); 2) Single quotes instead of double quotes (JSON mandates double quotation marks "" for all keys and strings); 3) Unquoted object keys; 4) Unescaped special characters like backslashes in Windows file paths; and 5) Attempting to store comments (// or /* */). Fixing these requires removing the trailing delimiter, wrapping all strings and keys in double quotes, escaping backslashes, and removing comments.
Key Takeaways
- RFC 8259 strictly prohibits trailing commas; a comma after the final item in an array or object triggers a fatal SyntaxError.
- All keys and string values must be enclosed in double quotation marks (""); single quotes (') are completely invalid in JSON.
- JSON supports only six data types: String, Number, Boolean, Object, Array, and null. It does not support undefined, functions, or dates.
- Standard JSON forbids comments; use JSONC, JSON5, or YAML if your configuration format requires inline documentation.
1. Why RFC 8259 Rejects Trailing Commas
Modern JavaScript, Python, and TypeScript developers love trailing commas because they make multi-line git diffs cleaner. Adding a new item to an array only modifies one line rather than two.
Why then does JSON stubbornly reject them? Because JSON was standardized as an interchange protocol for cross-platform interoperability across hundreds of disparate languages. In C, C++, and early parsing lexers, encountering a comma immediately conditioned the machine state to anticipate an incoming expression. If the next character was a closing delimiter, the lexer crashed on null pointer dereferences. To guarantee that every language from Fortran to JavaScript could reliably parse JSON, the standard adopted zero-tolerance parsing rules.
2. Handling Numbers and Precision Limits in JSON
A subtle bug in large-scale enterprise JSON systems is integer precision truncation. Standard JavaScript engines parse JSON numbers according to the IEEE 754 double-precision floating-point standard.
The maximum safe integer in JavaScript is Number.MAX_SAFE_INTEGER (2^53 - 1 or 9,007,199,254,740,991). If a backend database (such as PostgreSQL with 64-bit BIGINT or Twitter Tweet IDs) transmits an integer like 18446744073709551615, JSON.parse() will silently round the least significant digits! To preserve mathematical precision across 64-bit integers and monetary amounts, always serialize big integers as quoted strings in JSON.
3. Prototype Pollution and Deserialization Vulnerabilities
While raw JSON data is passive and cannot execute arbitrary code directly, naive handling of parsed JSON objects in JavaScript can introduce critical security flaws known as Prototype Pollution (CWE-1321).
When an application merges incoming JSON objects recursively into server state without property key validation, a malicious payload containing keys like `"__proto__"` or `"constructor.prototype"` can overwrite global Object prototypes. If an attacker injects `{"__proto__": {"isAdmin": true}}`, every unprivileged user session inheriting from Object in your Node.js application is suddenly granted administrative permissions.
To prevent prototype pollution: 1) Validate incoming payloads against strict schema contracts using Zod or AJV; 2) Freeze critical prototypes using `Object.freeze(Object.prototype)`; and 3) Use `Object.create(null)` for key-value dictionary maps.
4. JSON vs JSON5 vs YAML: Choosing the Right Configuration Format
Developers frequently express frustration with standard JSON’s lack of comments and strict quotation rules. Understanding the alternatives prevents using the wrong tool for the job:
• Standard JSON (RFC 8259): The universal standard for inter-system machine API communication. Strict, lightweight, supported natively by every language on earth. Zero comments.
• JSON5: An official superset designed for human maintainability. Permits trailing commas, single quotes, unquoted keys, hexadecimal numbers, and single/multi-line comments. Ideal for local development configurations (like tsconfig.json or babelrc).
• YAML (YAML Ain't Markup Language): Whitespace-indented format widely adopted for DevOps manifests (Docker Compose, Kubernetes, GitHub Actions). Highly readable but prone to invisible indentation bugs and slower parsing speeds.
5. JSON Schema Validation: Enforcing Production Data Contracts
In production web APIs, validating that an incoming payload is syntactically well-formed JSON is merely the first baseline step. A payload may be valid JSON but completely fail domain logic by omitting mandatory fields or passing negative values into monetary parameters.
The international standard for declaring structural contracts is JSON Schema (currently Draft 2020-12). By compiling declarative schema documents defining property types, required field arrays, regex string constraints (such as validating an Indian PAN `^[A-Z]{5}[0-9]{4}[A-Z]{1}$`), and specifying `additionalProperties: false`, backend systems can reject malformed client submissions at the HTTP gateway before bad data ever touches application business logic or database persistence layers.
Modern TypeScript architectures often pair JSON Schema with automated schema-to-type generators or libraries like Zod and TypeBox. This enables static compile-time type safety derived directly from runtime schema definitions, guaranteeing that frontend forms, API gateways, and database serialization code remain 100% synchronized without writing fragile manual type assertions.
Worked Example: Debugging a Severely Corrupted Configuration Payload
A developer configures an application config file that crashes the Node.js backend with "SyntaxError: Unexpected token , in JSON at position 142".
| Syntax Failure in Raw Code | Why JSON Engine Fails | Corrected RFC 8259 JSON Syntax |
|---|---|---|
| 'serviceName': 'payment-gateway' | Single quotes used instead of double quotes | "serviceName": "payment-gateway" |
| timeout: 5000 | Key is bare and unquoted | "timeout": 5000 |
| "retries": 3, // retry 3 times | Inline comment is illegal in standard JSON | "retries": 3 (comment removed) |
| "logPath": "C:\logs\app.log" | Unescaped backslashes in Windows file path | "logPath": "C:\\logs\\app.log" |
| "endpoints": ["/auth", "/pay",], | Trailing comma before closing bracket and brace | "endpoints": ["/auth", "/pay"] |
Conclusion: Applying quotation normalization, backslash escaping, comment stripping, and removing trailing commas transforms the broken text into 100% valid, production-ready JSON.
The 7 Most Deadly JSON Syntax Traps and Their Resolutions
Quick troubleshooting guide for backend and frontend API developers.
| Error Pattern | Broken Example Code | V8 Parser Error Message | Production Fix |
|---|---|---|---|
| Trailing Comma | {"name": "dmrs", "active": true,} | Unexpected token } in JSON | Delete the comma after true |
| Single Quotes | {'status': 'ok'} | Unexpected token ' in JSON | Replace ' with standard " quotes |
| Unquoted Keys | {status: "ok"} | Unexpected token s in JSON | Wrap key in double quotes: {"status": "ok"} |
| Unescaped Backslash | {"path": "C:\temp"} | Bad escaped character in JSON | Double the backslash: {"path": "C:\\temp"} |
| JavaScript Comments | {"port": 8080 /* prod */} | Unexpected token / in JSON | Remove all comments completely |
| Leading Zeros on Numbers | {"code": 052} | Unexpected number in JSON | Remove leading zero or treat as string "052" |
| NaN or Infinity Values | {"limit": Infinity} | Unexpected token I in JSON | Replace with null or numerical value 999999 |
Mistakes I See Most Often (From Experience)
- Serializing undefined Values: JSON does not support undefined. Passing { user: undefined } to JSON.stringify() causes the key to vanish silently from the output.
- Pasting Python Booleans: Python prints True and False with capital letters. JSON parser requires lowercase true and false.
- Forgetting Circular Reference Errors: Attempting to serialize JavaScript objects that reference themselves (a.parent = b; b.child = a) triggers a fatal TypeError: Converting circular structure to JSON.
- Using eval() to Parse Untrusted JSON: Never use eval("("+str+")") to parse JSON. Doing so creates catastrophic XSS vulnerabilities; always use native JSON.parse().
Authoritative References & Government Sources
- RFC 8259 The JavaScript Object Notation (JSON) Data Interchange Format ↗ IETF standard defining grammar, character encoding, and parsing syntax for JSON.
- ECMA-404 The JSON Data Interchange Standard ↗ Official ECMAScript specification for JSON syntax.
Written & Verified by SUMAN TR
Lead Developer & Publisher • Bengaluru, India
SUMAN TR is a seasoned WordPress developer, technical SEO specialist, and web publisher based in Bengaluru, India. With over 8 years of hands-on experience designing high-speed digital architectures and custom web utilities, Suman focuses on creating zero-bloat client-side calculation engines and practical, jargon-free guides tailored to Indian financial and web standards.
Calculate Your Numbers in Real-Time
Test the formulas and scenarios described in this guide using our fast, client-side calculator:
Launch JSON Formatter, Validator & Minifier →