>"Integers in JSON data will probably be handled similarly to other unsupported data such as symbols:"

    >JSON.stringify(123n)

    undefined

I guess their proposal accounted for this by not supporting integers at all. But this could still be possible if you knew a service was coercing a string or similar into an Integer type (using proposed Integer.parseInt).

It's important to remember that JSON is "very close" to Javascript but is not actually Javascript. JSON allows arbitrary precision numbers. So, the number `1.0000000000000001` (or, similarly, an extremely large integer) isn't representable in standard Javascript, but if a JSON encoder emits that, a "proper" parser would actually parse that as an exact value (compare Python `simplejson.parse` with `use_decimal=True` vs `use_decimal=False`). I guess what I'm saying is that a proper JSON parser kinda already has this issue.

You could already send gigabytes of JSON garbage right now and DDoS them...

Also i don't think this has anything to do with JSON.

How is this attack vector any different from sending an arbitrarily large string?