Go 1.27 ships a new JSON API that rejects duplicate keys and invalid UTF-8
A New Go API for JSON
Go 1.27 introduces encoding/json/v2 and jsontext, a stable redesign of the standard library's JSON support. The new packages fix long-standing flaws: they reject invalid UTF-8 and duplicate object names by default, marshal nil slices as empty arrays, and offer true streaming with options passed directly to Marshal and Unmarshal. New interfaces like MarshalJSONTo and UnmarshalJSONFrom eliminate redundant parsing and allocation, making JSON handling faster and safer.
The presence of a duplicate name results in a JSON value without a universally agreed upon meaning. This could be exploited by attackers in security applications and has been exploited before.