java.lang.Character JSON Bug In Adobe ColdFusion 2025

The other day, I added an error log viewer to the local development environment for Big Sexy Poems. The error processing pipeline writes a JSON-encoded version of the error payload to the local file system before sending it off to Bugsnag. Then, in my local error log viewer, I parse the JSON files and render them as <details> disclosure widgets. Only, this morning, the JSON parsing started breaking in Adobe ColdFusion 2025.

The error was clear, but the root cause was not. The error was that one of the JSON payloads was malformed. However, since I'm having Adobe ColdFusion generate the JSON payloads, the cause of the malformed syntax was mysterious.

After a good deal of debugging, I finally narrowed it down to the fact that a JSON-parsing error includes non-standard string values in its own error object. Then, when I have Adobe ColdFusion serialize said error as JSON, it doesn't properly escape the non-standard string values.

To demonstrate, we can create a ColdFusion struct with an instance of the char data-type that represents a double-quote:

<cfscript>

	data = { value: javaCast( "char", '"' ) };

	// Try to serialize the structure with embedded char.
	writeOutput( "<pre>#encodeForHtml( serializeJson( data ) )#</pre>" );

	try {

		// Try to deserialize the stringified value with embedded char.
		deserializeJson( serializeJson( data ) );

	} catch ( any error ) {

		writeDump( error );

	}

</cfscript>

As you can see, all we're doing here is taking the value:

javaCast( "char", '"' )

... and then trying to run it through the JSON serialization / deserialization workflow. But, attempting to run this through Adobe ColdFusion 2025, Update 6 gives us the following:

From this screenshot, we can see several things:

1. In the serializeJson() output, we can see what looks like three double-quotes in a row. This is the malformed part of the JSON string. The middle quote should be escaped \"; however since it was a char, it seems that ColdFusion doesn't properly escape it.

2. In the error that gets thrown from the deserializeJson() call, we can see the problematic char in the character property.

Since parsing a malformed JSON object (of this type) creates yet another error that contains a char that can't be serialized properly, this ended up creating a sort of "poisoned pill" in my logging system. I'll have to update my logic to put a try/catch around the JSON parsing to get past it.

I'll file a bug in the Adobe Bug Tracker once I get this posted.

Want to use code from this post? Check out the license.

Short link: https://bennadel.com/4878

Reader Comments

Ben Nadel Mar 1, 2026 at 2:20 PM

16,163 Comments

Logged bug in the bug tracker: CF-4230430.

Ben Nadel Mar 1, 2026 at 4:15 PM

16,163 Comments

I've updated Big Sexy Poems to use a safe JSON parsing routine until this bug gets fixed. It works using a try/catch and then falling back to something that is compatible with the log-viewer. Since this is specific to the log-viewing module in the app, I don't think it needs to be a global function. This is admittedly an edge-case.

Post A Comment — ❤️ I'd Love To Hear From You! ❤️

Post a Comment →