diff --git a/src/json.hpp b/src/json.hpp
index 56d6f3f09f..079868ad2e 100644
--- a/src/json.hpp
+++ b/src/json.hpp
@@ -4678,7 +4678,7 @@ class basic_json
                     if (c >= 0x00 and c <= 0x1f)
                     {
                         // print character c as \uxxxx
-                        sprintf(&result[pos + 1], "u%04x", int(c));
+                        snprintf(&result[pos + 1], result.size(), "u%04x", int(c));
                         pos += 6;
                         // overwrite trailing null character
                         result[pos] = '\\';
diff --git a/src/json.hpp.re2c b/src/json.hpp.re2c
index c38e452edf..0bda8428ee 100644
--- a/src/json.hpp.re2c
+++ b/src/json.hpp.re2c
@@ -4678,7 +4678,7 @@ class basic_json
                     if (c >= 0x00 and c <= 0x1f)
                     {
                         // print character c as \uxxxx
-                        sprintf(&result[pos + 1], "u%04x", int(c));
+                        snprintf(&result[pos + 1], result.size(), "u%04x", int(c));
                         pos += 6;
                         // overwrite trailing null character
                         result[pos] = '\\';