diff --git a/src/json.hpp b/src/json.hpp
index aa262ae3f..243399da0 100644
--- a/src/json.hpp
+++ b/src/json.hpp
@@ -4697,7 +4697,7 @@ class basic_json
                     if (c >= 0x00 and c <= 0x1f)
                     {
                         // print character c as \uxxxx
-                        sprintf(&result[pos + 1], "u%04x", int(c));
+                        snprintf(&result[pos + 1], result.size(), "u%04x", int(c));
                         pos += 6;
                         // overwrite trailing null character
                         result[pos] = '\\';
diff --git a/src/json.hpp.re2c b/src/json.hpp.re2c
index 88391d61d..90f48bd3c 100644
--- a/src/json.hpp.re2c
+++ b/src/json.hpp.re2c
@@ -4697,7 +4697,7 @@ class basic_json
                     if (c >= 0x00 and c <= 0x1f)
                     {
                         // print character c as \uxxxx
-                        sprintf(&result[pos + 1], "u%04x", int(c));
+                        snprintf(&result[pos + 1], result.size(), "u%04x", int(c));
                         pos += 6;
                         // overwrite trailing null character
                         result[pos] = '\\';