The JSON standard (RFC 8259) does not mandate how parsers should handle duplicate keys in objects, leading to inconsistent behavior across different libraries. While some parsers take the last value, others like pysimdjson return the first, and newer versions of Go (1.27+) reject such objects entirely.
This discrepancy creates security risks when a gateway and a backend service use different parsers. A gateway might authorize a request based on one key, while the backend service processes a different value from the same JSON body, potentially leading to unauthorized access.
Numeric handling also varies, as the standard only guarantees precision for integers between negative 2 to the power of 53 minus 1 and 2 to the power of 53 minus 1. Large identifiers can be silently converted to float64 by JavaScript or Go, resulting in incorrect data lookups.
Furthermore, libraries handle non-standard values like NaN differently. Python's json.dumps allows NaN by default, producing invalid JSON, while other tools may convert it to null or a string, causing data loss or silent failures in downstream systems.
To mitigate these issues, developers should adopt the I-JSON profile, which mandates strict key uniqueness and string representation for large numbers. Implementing a strict parser at the system entry point and normalizing data before internal transmission prevents inconsistent interpretations across components.
