VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/tidwall/gjson: vulnerability history, versions and safety

github.com/tidwall/gjson is a package in the Go ecosystem. Vulert records 11 vulnerabilities for it across 120 releases, from Apr 2021 to Feb 2023. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
11 vulnerabilities recorded H5 U6
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/tidwall/gjson vulnerabilities

Vulert verdict on github.com/tidwall/gjson v1.20.0 i

Updated on 22 Oct 2026

Action needed: v1.20.0 has 11 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 81/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.20.0 — affected i
  • Vulnerabilities on record 11 over 1 year · 0 in the last year i
  • Latest disclosure 06 Feb 2023 i
  • Highest CVSS 7.5 i
  • With no published fix 0 i
  • Stars 15,561 i
  • OpenSSF scorecard 2/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/tidwall/gjson, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.20.0 05 Oct 2026 H5 U6 MIT Yes Details →
v1.19.1 03 Oct 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20261003013400-9378d3bb93e2 03 Oct 2026 H5 U6 MIT Yes Details →
v1.18.1-0.20260828000700-8d89927eff41 28 Aug 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20260828000700-8d89927eff41 28 Aug 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20260514151005-7d8b3821e9d2 14 May 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20260514150010-896d5690900c 14 May 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20260514145942-27a65e44f8b8 14 May 2026 H5 U6 MIT Yes Details →
v1.19.1-0.20260512153703-e5cb9d0e0a59 12 May 2026 H5 U6 MIT Yes Details →
v0.0.0-20260508211541-0fac2c9aa6eb 08 May 2026 H5 U6 MIT Yes Details →
v1.19.0 08 May 2026 H5 U6 MIT Yes Details →
v0.0.0-20241010104348-4d230282c0e3 10 Oct 2024 H5 U6 MIT Yes Details →
v1.18.1-0.20241010104348-4d230282c0e3 10 Oct 2024 H5 U6 MIT Yes Details →
v1.18.1-0.20241010103852-10d26621bfe1 10 Oct 2024 H5 U6 MIT Yes Details →
v1.18.1-0.20241008011410-4a91ee1eba17 08 Oct 2024 H5 U6 MIT Yes Details →
v1.17.4-0.20241002034520-133f42ce2d99 02 Oct 2024 H5 U6 MIT Yes Details →
v1.18.0 02 Oct 2024 H5 U6 MIT Yes Details →
v1.17.4-0.20241002030310-92dff34b255b 02 Oct 2024 H5 U6 MIT Yes Details →
v1.17.3 30 Jul 2024 H5 U6 MIT Yes Details →
v1.17.3-0.20240730114727-5ab551f3ac05 30 Jul 2024 H5 U6 MIT Yes Details →
v0.0.0-20240729140806-28d458b14c40 29 Jul 2024 H5 U6 MIT Yes Details →
v1.17.2 29 Jul 2024 H5 U6 MIT Yes Details →
v1.17.2-0.20240729140806-28d458b14c40 29 Jul 2024 H5 U6 MIT Yes Details →
v1.17.2-0.20240603011206-c2bc5a409a22 03 Jun 2024 H5 U6 MIT Yes Details →
v1.17.2-0.20240423021258-2ba56cc0866e 23 Apr 2024 H5 U6 MIT Yes Details →
v1.17.2-0.20240415034324-5d0d40c89f4c 15 Apr 2024 H5 U6 MIT Yes Details →
v1.17.1 15 Feb 2024 H5 U6 MIT Yes Details →
v1.17.1-0.20240215035140-bbf40bb0e4f4 15 Feb 2024 H5 U6 MIT Yes Details →
v1.17.1-0.20240215024613-711c6fe9ecb7 15 Feb 2024 H5 U6 MIT Yes Details →
v1.17.1-0.20240214201512-0f87896dc39d 14 Feb 2024 H5 U6 MIT Yes Details →
v1.17.1-0.20240214201405-b622071bec95 14 Feb 2024 H5 U6 MIT Yes Details →
v0.0.0-20230922171356-6ee9f877d683 22 Sep 2023 H5 U6 MIT Yes Details →
v1.16.1-0.20230922171356-6ee9f877d683 22 Sep 2023 H5 U6 MIT Yes Details →
v1.17.0 22 Sep 2023 H5 U6 MIT Yes Details →
v1.16.1-0.20230922165414-be1bb7d64ac7 22 Sep 2023 H5 U6 MIT Yes Details →
v1.15.1-0.20230809220936-1ff915dd81b0 09 Aug 2023 H5 U6 MIT Yes Details →
v1.16.0 09 Aug 2023 H5 U6 MIT Yes Details →
v1.15.1-0.20230809215446-e8e87f2a00dc 09 Aug 2023 H5 U6 MIT Yes Details →
v1.14.5-0.20230727132349-8d2c36ffa413 27 Jul 2023 H5 U6 MIT Yes Details →
v1.15.0 27 Jul 2023 H5 U6 MIT Yes Details →
v0.0.0-20221122015456-e14b8d37087f 22 Nov 2022 H5 U6 MIT Yes Details →
v1.14.4 22 Nov 2022 H5 U6 MIT Yes Details →
v1.14.4-0.20221122015224-f37cc44a28aa 22 Nov 2022 H5 U6 MIT Yes Details →
v1.14.4-0.20221121063746-1ed0d856e3ff 21 Nov 2022 H5 U6 MIT Yes Details →
v1.14.4-0.20221114041528-0fc85398c823 14 Nov 2022 H5 U6 MIT Yes Details →
v1.14.4-0.20221031145638-25df3e611a9c 31 Oct 2022 H5 U6 MIT Yes Details →
v0.0.0-20220816134406-8bf80a300b41 16 Aug 2022 H5 U6 MIT Yes Details →
v1.14.3 16 Aug 2022 H5 U6 MIT Yes Details →
v1.14.3-0.20220809134128-9e848707d6d3 09 Aug 2022 H5 U6 MIT Yes Details →
v1.14.2 05 Aug 2022 H5 U6 MIT Yes Details →
v1.14.2-0.20220621204908-980f12c60e5b 21 Jun 2022 H5 U6 MIT Yes Details →
v1.14.2-0.20220615085908-72953c747288 15 Jun 2022 H5 U6 MIT Yes Details →
v1.14.2-0.20220613133827-f37ee93f135f 13 Jun 2022 H5 U6 MIT Yes Details →
v1.14.2-0.20220514173326-e20a0bfa6196 14 May 2022 H5 U6 MIT Yes Details →
v1.14.1 19 Apr 2022 H5 U6 MIT Yes Details →
v1.14.1-0.20220419221433-c3bb2c39ba20 19 Apr 2022 H5 U6 MIT Yes Details →
v1.14.1-0.20220322163019-56c0a0aa5b8f 22 Mar 2022 H5 U6 MIT Yes Details →
v1.14.0 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220202115831-1abd525f6d62 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220202115703-fce6fec0983d 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220202115259-05e9ee14237d 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220202114911-82f549e6ee78 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220202114304-e4fc67c92aee 02 Feb 2022 H5 U6 MIT Yes Details →
v1.13.1-0.20220114011920-f47e17d70abf 14 Jan 2022 H5 U6 MIT Yes Details →
v1.13.0 13 Jan 2022 H5 U6 MIT Yes Details →
v1.12.2-0.20211210162312-ba95ef80b501 10 Dec 2021 H5 U6 MIT Yes Details →
v1.12.2-0.20211208164211-65bbebbdf740 08 Dec 2021 H5 U6 MIT Yes Details →
v0.0.0-20211201002007-db0033701ccc 01 Dec 2021 H5 U6 MIT Yes Details →
v1.12.1 01 Dec 2021 H5 U6 MIT Yes Details →
v1.12.1-0.20211130172250-bd7621203094 30 Nov 2021 H5 U6 MIT Yes Details →
v1.12.1-0.20211130171836-9eae1fa87b82 30 Nov 2021 H5 U6 MIT Yes Details →
v1.12.0 25 Nov 2021 H5 U6 MIT Yes Details →
v1.11.1-0.20211110161818-6b6af2ad5e5c 10 Nov 2021 H5 U6 MIT Yes Details →
v1.11.0 30 Oct 2021 H5 U6 MIT Yes Details →
v1.10.3-0.20211028160900-7cadbb575617 28 Oct 2021 H5 U6 MIT Yes Details →
v1.10.2 25 Oct 2021 H5 U6 MIT Yes Details →
v1.10.2-0.20211022121012-8ac7a764ca2d 22 Oct 2021 H5 U6 MIT Yes Details →
v1.10.1 22 Oct 2021 H5 U6 MIT Yes Details →
v1.10.1-0.20211022110541-5784e4879e8c 22 Oct 2021 H5 U6 MIT Yes Details →
v1.10.1-0.20211022110022-0cbc0f402f9f 22 Oct 2021 H5 U6 MIT Yes Details →
v1.10.0 20 Oct 2021 H5 U6 MIT Yes Details →
v0.0.0-20211012175230-4fe1916c56fb 12 Oct 2021 H5 U6 MIT Yes Details →
v1.9.4 12 Oct 2021 H5 U6 MIT Yes Details →
v1.9.3 08 Oct 2021 H5 U6 MIT Yes Details →
v1.9.2 04 Oct 2021 H5 U6 MIT Yes Details →
v1.9.1 15 Sep 2021 H5 U6 MIT Yes Details →
v1.9.1-0.20210907125448-78289be4edb1 07 Sep 2021 H5 U6 MIT Yes Details →
v1.9.1-0.20210901143346-75046d2a7a89 01 Sep 2021 H5 U6 MIT Yes Details →
v1.9.1-0.20210901142729-5827eb3b24ec 01 Sep 2021 H5 U6 MIT Yes Details →
v1.9.0 01 Sep 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210901142415-44b8c19d8756 01 Sep 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210901142400-160fb9d6a148 01 Sep 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210901141747-52919fa7b088 01 Sep 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210719085618-21a77fab7dfe 19 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210709231556-7405f21134db 09 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210707140643-a5e52e5b06b4 07 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210707015223-d3daff01853c 07 Jul 2021 H5 U6 MIT Yes Details →
v1.8.1-0.20210701110044-7460ecfe6948 01 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210701110044-7460ecfe6948 01 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210701105826-9b49f6eef56e 01 Jul 2021 H5 U6 MIT Yes Details →
v1.8.2-0.20210701105824-73b86a9fc9d6 01 Jul 2021 H5 U6 — Yes Details →
v1.8.2-0.20210701105736-34ea51174654 01 Jul 2021 H5 U6 — Yes Details →
v1.8.1 30 Jun 2021 H5 U6 — Yes Details →
v0.0.0-20210514160832-ca5c4b1e2671 14 May 2021 H5 U6 — Yes Details →
v1.8.1-0.20210514160832-ca5c4b1e2671 14 May 2021 H5 U6 — Yes Details →
v1.8.1-0.20210514160212-7a0721334f86 14 May 2021 H5 U6 — Yes Details →
v1.8.1-0.20210514155836-3c1163452285 14 May 2021 H5 U6 — Yes Details →
v1.8.0 14 May 2021 H5 U6 — Yes Details →
v1.7.6-0.20210512193801-51e0e24a1334 12 May 2021 H5 U6 — Yes Details →
v1.7.5 19 Apr 2021 H5 U6 — Yes Details →
v1.7.5-0.20210419161803-d6d786db3c80 19 Apr 2021 H5 U6 — Yes Details →
v1.7.5-0.20210419161324-8ac92b3ad3d7 19 Apr 2021 H5 U6 — Yes Details →
v1.7.5-0.20210412194148-f3ac38cbb5dc 12 Apr 2021 H5 U6 — Yes Details →
v1.7.5-0.20210402144740-7dde6ac0f68b 02 Apr 2021 H5 U6 — Yes Details →
v1.7.5-0.20210402020329-03014072239c 02 Apr 2021 H5 U6 — Yes Details →
v1.7.4 29 Mar 2021 H5 U6 — Yes Details →
v1.7.4-0.20210328155952-15a2428baee4 28 Mar 2021 H5 U6 — Yes Details →
v1.7.4-0.20210327202445-9e749076bfba 27 Mar 2021 H5 U6 — Yes Details →
v1.7.4-0.20210327190630-68c884f54596 27 Mar 2021 H5 U6 — Yes Details →
v1.7.4-0.20210327190513-e78ccfebe428 27 Mar 2021 H5 U6 — Yes Details →

The newest 120 of 377 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 5
  • 2022 5
  • 2023 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 11 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/tidwall/gjson

The 5 most severe of 11 vulnerabilities recorded for this package

Search all 11 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2021-42836: Regular Expression Denial of Service in gjson 7.5 high 1.9.3 25 Oct 2021
CVE-2020-35380: Denial of Service in GJSON 7.5 high 1.6.4 23 Jun 2021
CVE-2020-36066: Denial of Service in github.com/tidwall/gjson 7.5 high 1.6.5 18 May 2021
CVE-2021-42248: ReDoS via crafted JSON input in GJSON 7.5 high 1.9.3 25 May 2022
CVE-2020-36067: Improper Validation of Array Index in GJSON 7.5 high 1.6.6 06 Feb 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/tidwall/gjson

Is github.com/tidwall/gjson safe to use?

Vulert records 11 vulnerabilities for github.com/tidwall/gjson in Go: 0 critical, 5 high, 0 medium and 0 low, plus 6 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/tidwall/gjson's Vulert package health score?

Vulert scores github.com/tidwall/gjson 81/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/tidwall/gjson affected?

Yes. v1.20.0, the version you would install today, has 11 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/tidwall/gjson should I use?

v1.20.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/tidwall/gjson have?

11 vulnerabilities are recorded for github.com/tidwall/gjson in the Go ecosystem: 0 critical, 5 high, 0 medium and 0 low, plus 6 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/tidwall/gjson vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/tidwall/gjson in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/tidwall/gjson are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/tidwall/gjson for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/tidwall/gjson version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.