Because JSON can include floating-point numbers. If you pass { foo: 2.2250738585072012e-308 } to any JSON service, I'd expect it to invoke Double.parseDouble(...) as part of its input processing, and trip over the bug. This would probably occur before any type checking of the input, and thus would probably work even for a service which does not expect floating-point inputs.

This is not correct. Think about a service which used PHP's json_decode function. PHP has fixed this bug, so there would be no issue.

The problem has nothing to do with JSON. It only affects JSON parsers that run on a JVM.

Right -- when I said "any service that accepts JSON input", I meant "any JVM-based service that accepts JSON input". I thought the JVM qualification would be clear from the context of this thread, apologies if it wasn't.

So the exact same bug affects Javascript?

JSON just makes it quite easy to parse in a floating point number. But that doesn't have anything to do with Javascript per-se.