Raw NUL byte inside a JSON string
A U+0000 byte in string content, usually from a C string boundary, a fixed-width database column, or binary data that was treated as text.
The input
{"a": "x y"}{"a": "x\u0000y"}How to fix it
Escape it as `\u0000`, or — better — base64-encode binary data instead of putting raw bytes in a string.
If you are seeing NUL bytes, check whether the field should be binary. JSON strings are sequences of Unicode characters, not byte buffers.
What each parser reports
Every message below was captured by running this exact input through the parser named. 14 of 21 parsers rejected it; 7 accepted it.
| Parser | Exact message |
|---|---|
| CPython json.loads CPython 3.12.3 | Invalid control character at: line 1 column 9 (char 8)what this message means → |
| encoding/json Unmarshal Go go1.22.2 | invalid character '\x00' in string literalwhat this message means → |
| Gson Java 21.0.12 | accepted — no error |
| Gson JsonParser (lenient off) Java 21.0.12 | accepted — no error |
| hjson Node.js 22.22.2 | accepted — no error |
| Jackson ObjectMapper Java 21.0.12 | Illegal unquoted character ((CTRL-CHAR, code 0)): has to be escaped using backslash to be included in string valuewhat this message means → |
| JavaScriptCore JSON.parse JavaScriptCore (Bun 1.4.1) | JSON Parse error: Unterminated stringwhat this message means → |
| json-bigint Node.js 22.22.2 | accepted — no error |
| JSON5 Node.js 22.22.2 | accepted — no error |
| JSON::PP Perl 5.038002 | invalid character 0x0 encountered while parsing JSON string, at character offset 8 (before "\x{0}y"}")what this message means → |
| json_decode PHP 8.3.6 | Control character error, possibly incorrectly encoded |
| Newtonsoft.Json JsonConvert Newtonsoft.Json 13.0.3 on .NET 8.0.30 | accepted — no error |
| Newtonsoft.Json JsonTextReader Newtonsoft.Json 13.0.3 on .NET 8.0.30 | accepted — no error |
| orjson CPython 3.12.3 | unexpected control character in string: line 1 column 9 (char 8)what this message means → |
| Ruby JSON.parse Ruby 3.2.3 | unexpected token at '{"a": "x' |
| serde_json::from_str Rust (serde_json 1.x) | control character (\u0000-\u001F) found while parsing a string at line 1 column 9what this message means → |
| SpiderMonkey JSON.parse SpiderMonkey 115 | JSON.parse: bad control character in string literal at line 1 column 9 of the JSON datawhat this message means → |
| System.Text.Json Deserialize .NET 8.0.30 | '0x00' is invalid within a JSON string. The string should be correctly escaped. Path: $ | LineNumber: 0 | BytePositionInLine: 8.what this message means → |
| System.Text.Json JsonDocument .NET 8.0.30 | '0x00' is invalid within a JSON string. The string should be correctly escaped. LineNumber: 0 | BytePositionInLine: 8.what this message means → |
| ujson CPython 3.12.3 | Unmatched '"' when decoding 'string'what this message means → |
| V8 JSON.parse Node.js 22.22.2 | Bad control character in string literal in JSON at position 8 (line 1 column 9)what this message means → |
What the specification says
The exact sections that govern this error. Descriptions are our paraphrase; follow the links for the normative text.
| Body | Section |
|---|---|
| IETF | A string begins and ends with a quotation mark. Any Unicode character may appear between them except the quotation mark, the reverse solidus, and the control characters U+0000 through U+001F, which the section requires to be escaped. It also fixes the escape set and the \uXXXX form. |
| Ecma International | A string is code points wrapped in quotation marks; the quotation mark, reverse solidus and U+0000–U+001F must be escaped. Table 3 fixes the escape sequences. |
Other errors in this category
Literal newline inside a JSON string
A real line break between the quotes. JSON forbids unescaped control characters (U+0000 to U+001F) inside strings, and a newline i…
Literal tab inside a JSON string
A raw tab character inside string content. Like a newline, it is a control character and must be escaped.…
Invalid escape sequence in a JSON string
A backslash followed by a character JSON does not define. The complete set is `\" \\ \/ \b \f \n \r \t` and `\uXXXX`. Windows path…
Malformed \u escape in a JSON string
A `\u` not followed by exactly four hexadecimal digits.…
Truncated \u escape in a JSON string
A `\u` escape with fewer than four hex digits, typically where a string was cut mid-escape by a length limit.…
Lone surrogate in a JSON string
A high surrogate (`\uD800`–`\uDBFF`) with no following low surrogate. Characters outside the Basic Multilingual Plane — emoji, mos…