JavaScript · The language round

What are the pitfalls of JSON.parse and JSON.stringify?

MediumJSONserializationdataUpdated Oct 2026
Quiz this track

Short answer

JSON only supports a subset of JavaScript values. stringify drops undefined, functions and symbols, turns dates into strings, and throws on BigInt and cycles. parse can also be dangerous on untrusted input if the result is merged blindly.

JSON is a data format, not a JavaScript object serializer. Values that exist in JavaScript but not in JSON are either omitted, converted or rejected.

js
const source = {
  name: "Asha",
  missing: undefined,
  greet() {},
  when: new Date("2026-01-01"),
};

console.log(JSON.stringify(source));
// {"name":"Asha","when":"2026-01-01T00:00:00.000Z"}

JSON.stringify({ value: 10n }); // TypeError

const circular = {};
circular.self = circular;
// JSON.stringify(circular); // TypeError: circular structure

What gets lost

  • undefined, functions and symbols are omitted from objects
  • In arrays, those values become null
  • Date is converted to an ISO string, not a Date
  • BigInt throws
  • Circular references throw
  • Class prototypes and non-enumerable properties are not preserved

JSON.parse accepts a reviver function for transforming values, and JSON.stringify accepts a replacer function or array for filtering. A toJSON method lets an object control its own serialization.

js
const parsed = JSON.parse('{"when":"2026-01-01T00:00:00.000Z"}', (key, value) => {
  return key === "when" ? new Date(value) : value;
});

console.log(parsed.when instanceof Date); // true
Never merge parsed JSON directly into application objects without validation. Prototype-pollution payloads can include keys such as __proto__.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What happens to `undefined` in an object during stringify?
  2. 2How do you serialize a `Date` and restore it?
  3. 3Why does `JSON.stringify` throw on a circular object?
  4. 4How can parsed JSON create a prototype-pollution risk?

Say it in the interview

JSON supports only a subset of JavaScript values. stringify drops undefined, functions and symbols from objects, turns dates into strings, and throws on BigInt or cycles. parse has a reviver and stringify has a replacer, which lets me restore dates or filter fields. I validate parsed input before merging it, because untrusted JSON can carry prototype-pollution keys.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live JavaScript mock interview and get scored feedback on depth, clarity and confidence.