RUSTSEC-2023-0087: `MaybeUninit` misuse in `simd-json-derive`

What to do

1. See which version you have: cargo tree -i simd-json-derive (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p simd-json-derive. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example simd-json-derive = "0.12.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)

The 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.

References

• Package: crates.io/crates/simd-json-derive
• Advisory: rustsec.org/advisories/RUSTSEC-2023-0087.html
• Report: github.com/simd-lite/simd-json-derive/issues/67

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.