---
id: CVE-2025-67221
aliases:
  - GHSA-hx9q-6w63-j58v
  - PYSEC-2026-107
title: orjson does not limit recursion for deeply nested JSON documents
summary: orjson does not limit recursion for deeply nested JSON documents
severity: high
vendor: orjson
product: orjson
ecosystem: pip
affected:
  - orjson < 3.11.6
patched:
  - orjson 3.11.6
published: '2026-01-22'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:33.258377926Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hx9q-6w63-j58v'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67221'
  - url: 'https://github.com/ijl/orjson/issues/620'
  - url: 'https://github.com/kpatsakis/CVE-2025-67221/issues/1'
  - url: >-
      https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370
  - url: 'https://github.com/ijl/orjson'
  - url: 'https://github.com/kpatsakis/orjson_vulnerability'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2026-107.yaml
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00643
epssPercentile: 0.48536
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/kpatsakis/CVE-2025-67221'
  checkedAt: '2026-09-25T08:20:48.353Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.703Z'
---

## Overview

The orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.

## Affected packages

- `orjson < 3.11.6`

## Remediation

Upgrade to a patched release:

- `orjson 3.11.6`