java.lang.Character JSON Bug In Adobe ColdFusion 2025

By Ben Nadel

Published 2026-03-01 in ColdFusion — Comments (1)

The other day, I added an error log viewer to the local development environment for Big Sexy Poems. The error processing pipeline writes a JSON-encoded version of the error payload to the local file system before sending it off to Bugsnag. Then, in my local error log viewer, I parse the JSON files and render them as <details> disclosure widgets. Only, this morning, the JSON parsing started breaking in Adobe ColdFusion 2025.

The error was clear, but the root cause was not. The error was that one of the JSON payloads was malformed. However, since I'm having Adobe ColdFusion generate the JSON payloads, the cause of the malformed syntax was mysterious.

After a good deal of debugging, I finally narrowed it down to the fact that a JSON-parsing error includes non-standard string values in its own error object. Then, when I have Adobe ColdFusion serialize said error as JSON, it doesn't properly escape the non-standard string values.

To demonstrate, we can create a ColdFusion struct with an instance of the char data-type that represents a double-quote:

<cfscript>

	data = { value: javaCast( "char", '"' ) };

	// Try to serialize the structure with embedded char.
	writeOutput( "<pre>#encodeForHtml( serializeJson( data ) )#</pre>" );

	try {

		// Try to deserialize the stringified value with embedded char.
		deserializeJson( serializeJson( data ) );

	} catch ( any error ) {

		writeDump( error );

	}

</cfscript>

As you can see, all we're doing here is taking the value:

javaCast( "char", '"' )

... and then trying to run it through the JSON serialization / deserialization workflow. But, attempting to run this through Adobe ColdFusion 2025, Update 6 gives us the following:

Screenshot of ColdFusion error re: malformed JSON payload parsing.

From this screenshot, we can see several things:

In the serializeJson() output, we can see what looks like three double-quotes in a row. This is the malformed part of the JSON string. The middle quote should be escaped \"; however since it was a char, it seems that ColdFusion doesn't properly escape it.
In the error that gets thrown from the deserializeJson() call, we can see the problematic char in the character property.

Since parsing a malformed JSON object (of this type) creates yet another error that contains a char that can't be serialized properly, this ended up creating a sort of "poisoned pill" in my logging system. I'll have to update my logic to put a try/catch around the JSON parsing to get past it.

I'll file a bug in the Adobe Bug Tracker once I get this posted.

Want to use code from this post? Check out the license.

Short link: https://bennadel.com/4878