JavaScript · The language round
What are the pitfalls of JSON.parse and JSON.stringify?
Short answer
JSON only supports a subset of JavaScript values. stringify drops undefined, functions and symbols, turns dates into strings, and throws on BigInt and cycles. parse can also be dangerous on untrusted input if the result is merged blindly.
JSON is a data format, not a JavaScript object serializer. Values that exist in JavaScript but not in JSON are either omitted, converted or rejected.
const source = {
name: "Asha",
missing: undefined,
greet() {},
when: new Date("2026-01-01"),
};
console.log(JSON.stringify(source));
// {"name":"Asha","when":"2026-01-01T00:00:00.000Z"}
JSON.stringify({ value: 10n }); // TypeError
const circular = {};
circular.self = circular;
// JSON.stringify(circular); // TypeError: circular structureWhat gets lost
undefined, functions and symbols are omitted from objects- In arrays, those values become
null Dateis converted to an ISO string, not a DateBigIntthrows- Circular references throw
- Class prototypes and non-enumerable properties are not preserved
JSON.parse accepts a reviver function for transforming values, and JSON.stringify accepts a replacer function or array for filtering. A toJSON method lets an object control its own serialization.
const parsed = JSON.parse('{"when":"2026-01-01T00:00:00.000Z"}', (key, value) => {
return key === "when" ? new Date(value) : value;
});
console.log(parsed.when instanceof Date); // true__proto__.Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What happens to `undefined` in an object during stringify?
- 2How do you serialize a `Date` and restore it?
- 3Why does `JSON.stringify` throw on a circular object?
- 4How can parsed JSON create a prototype-pollution risk?
Say it in the interview
JSON supports only a subset of JavaScript values. stringify drops undefined, functions and symbols from objects, turns dates into strings, and throws on BigInt or cycles. parse has a reviver and stringify has a replacer, which lets me restore dates or filter fields. I validate parsed input before merging it, because untrusted JSON can carry prototype-pollution keys.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live JavaScript mock interview and get scored feedback on depth, clarity and confidence.