Parsing and encoding errors: unexpected token, malformed input
"Unexpected token", "unexpected end of input", "invalid UTF-8", "malformed" — a parser rejected its input. The parser is almost never wrong; the interesting question is why the input isn't what you think it is, and the answer is usually one layer earlier than the error.
Read the message like a parser
| "Unexpected token < in JSON at position 0" | The input starts with < — it's HTML, not JSON. An error page, a login redirect, or a 404 came back where the API response should be. Log the raw body and the status code. |
| "Unexpected end of JSON input" | Truncated: an empty response body, a connection cut mid-transfer, or a partially written file. Valid JSON doesn't stop early. |
| "Unexpected token" mid-document | Genuinely malformed at that spot: trailing commas, single quotes, unescaped newline in a string, NaN/undefined serialized by hand-built formatting, or two JSON objects concatenated. |
| "Invalid UTF-8" / mojibake (é, ’) | Bytes in one encoding decoded as another — a Latin-1 database column read as UTF-8, a file saved in the wrong encoding, or binary data pushed through a text path. |
Look at the actual bytes
curl -s https://api.example.com/data | head -c 200 # what actually comes back? head -c 64 payload.json | xxd # BOM? binary? wrong file?
Most parse errors dissolve the moment you look at the raw input instead of the parsed
result: the "JSON" that is an HTML error page, the file with a UTF-8 BOM
(EF BB BF) that a strict parser rejects, the config saved as UTF-16 by a
Windows editor. If the error names a position, count to it — the byte offset points at the
exact problem in a way re-reading the code never will.
The layer-before rule
Treat a parse error as a symptom and find the producer: the API that returns HTML on error
(fix: check content-type and status before parsing), the shell pipeline that
mixed stderr into stdout, the template that string-concatenates JSON instead of using a
serializer, the double-encoded payload (JSON.stringify applied twice — the
tell is a quoted string full of \"). Hand-built serialization is the root
cause behind a remarkable share of these; use the library serializer, always name the file
and offset in your own error messages, and validate at the boundary so bad input fails
where it enters, not three modules later.
Documented occurrences
6,633 analyzed errors across 857 libraries match this failure class. Each links to the thrown message, its source line, and documented fixes.
jackwener/OpenCLI
- archive item returned malformed payload: files must be an array
- archive search returned malformed JSON: ${error?.message || error}
- archive search returned malformed payload for "${id}": downloads must be numeric
- archive search returned malformed payload: response.docs must be an array
- archive search returned malformed payload: result row is missing a stable identifier
- +460 more in OpenCLI
hashicorp/nomad
- failed to decode 0.8 driver state: %v
- failed to decode alloc: %v
- failed to decode and failed to read buffered data: %w
- failed to decode data into passed object: %v
- failed to decode Docker response: %w
- +118 more in nomad
cilium/cilium
- failed to decode base64-encoded NLRI: %w
- failed to decode base64-encoded Path Attribute: %w
- failed to decode features status from %s: %w
- failed to decode flow filters %q: %w
- failed to decode JSON %w
- +114 more in cilium
bytebase/bytebase
- CodeInvalidArgument: failed to parse expression
- CodeInvalidArgument: failed to parse %q
- CodeInvalidArgument: failed to parse %q
- failed to decode collection
- failed to decode emulator key
- +101 more in bytebase
nautechsystems/nautilus_trader
- C string contains invalid JSON
- C string contains invalid UTF-8
- Failed to decode API secret: {e}
- Failed to decode batch: {e}
- Failed to decode burn event data: {e}
- +93 more in nautilus_trader
dagger/dagger
- CoreModEnum.ConvertFromSDKResult: failed to decode input: %w
- CoreModScalar.ConvertFromSDKResult: failed to decode input: %w
- failed to decode arg type: %w
- failed to decode argument value: %w
- failed to decode argument: %w
- +89 more in dagger
can1357/oh-my-pi
- Anthropic cache refresh returned a malformed response
- Auth broker returned malformed JSON
- Cannot resume session "${resolvedSessionFile}": the session header is missing or malformed. The file was not modified.
- Codex session ${info.id} at ${info.path} is empty or malformed
- ${context} returned an invalid JSON object
- +68 more in oh-my-pi
apache/beam
- bigqueryio.queryFn: failed to decode query parameters
- Cannot get data catalog name for malformed topic path {}. Expected format: projects/<project>/topics/<topic>
- could not unmarshal CoderRef from %v, failed to decode CoderRef "%v"
- could not unmarshal CoderRef from %v, failed to decode urn-less coder's payload "%v"
- {errorContext}: unable to decode {encodedValue}, encoding of value {value}, using {coder}
- +66 more in beam
weaviate/weaviate
- failed to decode auth broker response: %w
- failed to decode auth broker response: %w
- failed to decode certificate
- failed to parse beacon %q: %w
- failed to parse certificate: %w
- +66 more in weaviate
kubernetes/kops
- could not parse private key (unable to decode PEM)
- failed on file asset: %s is invalid, unable to decode base64, error: %q
- failed to decode user data: %w
- failed to parse apiVersion %q
- failed to parse apiVersion %q
- +56 more in kops
…and 847 more libraries — search for your exact message.