security patch for JSON security flaw