Preconditions and environment

• Magento Open Source 2.4.7-p5 (also reproduced on 2.4.4-p13 per Non UTF-8 encoded URI component throws error in CatalogWidget module #23760 follow-up)
• PHP 8.2 / 8.3
• Block / FPC cache enabled
• Any CMS page containing Magento\CatalogWidget\Block\Product\ProductsList (or its rewrites / interceptors)

Steps to reproduce

1. Add a "Catalog Products List" widget to any CMS page (e.g. homepage).
2. Open that page with a malformed UTF-8 byte sequence in a query parameter, e.g.:
   • https://example.test/?q=%C0%AF (overlong UTF-8 slash)
   • https://example.test/?dclid=%EDclid
   • https://example.test/?utm_source=%E0
   • https://example.test/?fbclid=foo% (dangling percent)
3. Observe the rendered page and var/log/system.log.

These URLs occur in the wild from truncated Facebook / Google Ads tracking parameters (fbclid, gclid, dclid, utm_*), broken share buttons, and bot scanners.

Expected result

Widget renders normally. Malformed UTF-8 in the query string must not break server-side block rendering.

Actual result

Widget output is replaced by the generic CMS fallback message ("Sorry, we cannot generate the content...", localized) and the following entry is logged:

main.CRITICAL: InvalidArgumentException: Unable to serialize value.
Error: Malformed UTF-8 characters, possibly incorrectly encoded
  in vendor/magento/framework/Serialize/Serializer/Json.php:26

Abbreviated stack trace:

#0  vendor/magento/module-catalog-widget/Block/Product/ProductsList.php(235):
      Magento\Framework\Serialize\Serializer\Json->serialize()
#5  vendor/magento/framework/View/Element/AbstractBlock.php(1063):
      ProductsList->getCacheKeyInfo()
#6  AbstractBlock.php(1150): AbstractBlock->getCacheKey()
#7  AbstractBlock.php(676):  AbstractBlock->_loadCache()
#8  Interceptor->___callParent() → toHtml()
...
#82 vendor/magento/framework/App/Http.php(120): renderResult()
#92 pub/index.php(30): Bootstrap->run()

Root cause

Magento\CatalogWidget\Block\Product\ProductsList::getCacheKeyInfo() (line 235 of current 2.4-develop) passes raw $_GET (via $this->getRequest()->getParams()) to the serializer:

return [
    ...
    $this->json->serialize($this->getRequest()->getParams()),
    ...
];

Magento\Framework\Serialize\Serializer\Json::serialize() calls json_encode($value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) with no JSON_INVALID_UTF8_SUBSTITUTE / JSON_INVALID_UTF8_IGNORE flag. Any byte sequence in $_GET that is not valid UTF-8 causes json_encode to return false with JSON_ERROR_UTF8, which the serializer rethrows as InvalidArgumentException.

Because getCacheKeyInfo() is called from AbstractBlock::getCacheKey() → _loadCache() → toHtml(), the entire block fails to render and Magento falls back to the generic error template.

The same underlying defect surfaces in any other code path that serializes user-controlled input (request params, raw cookie values, certain redirect URLs). See also the ReCaptcha variant reported in #30486.

Related / prior reports

• Non UTF-8 encoded URI component throws error in CatalogWidget module #23760 — original report (2019). Marked as fixed in 2.4.3 via internal ticket MC-23846, but follow-up from @edas11 (2025-05-06) confirms reproduction on 2.4.7-p5 and 2.4.4-p13. This issue is filed to track the regression / incomplete fix.
• Magento_ReCaptcha... - Unable to serialize value. Error: Malformed UTF-8 characters, possibly incorrectly encoded #30486 — same root cause surfaced via Magento_ReCaptcha. Closed 2021.
• Onepage Checkout getSerializedCheckoutConfig fails silently if json_encode fails #17934 — analogous problem in checkout getSerializedCheckoutConfig (silent json_encode failure).
• Chinese product description utf error #23356, Added encode diacritics breaks on rp_token #37326, Properly handle multibyte characters in postcode templates for tax calculation #40304 — additional UTF-8 / multibyte handling regressions in core.

Suggested directions (not a fix proposal)

Listed only to clarify scope of the regression:

• Magento\Framework\Serialize\Serializer\Json::serialize() — pass JSON_INVALID_UTF8_SUBSTITUTE (or wrap in a guard that returns a safe placeholder).
• Magento\CatalogWidget\Block\Product\ProductsList::getCacheKeyInfo() — sanitize / hash $_GET instead of serializing it raw. Including the full $_GET in the cache key is also a separate performance / cache-fragmentation concern, since any unique URL parameter creates a new cache entry.

Severity / impact

• Reliability: any URL with malformed UTF-8 from third-party traffic sources renders an error region instead of the home / category / CMS page where the widget is placed.
• Reachability: trivial. A single crafted GET parameter is enough; no auth, no preconditions beyond the widget being on the page.
• Observability cost: every hit logs a CRITICAL to system.log, which can drown application logs under bot traffic.