It doesn't allocate itself, but it effectively forces a big allocation by only supporting []byte inputs. Typically people directly pass the request body to json.NewDecoder, as it implements the Reader interface.