Fix #6043: honor FAIL_ON_UNKNOWN_PROPERTIES for creator-based POJOs-as-Array

release-notes/CREDITS

@@ -579,3 +579,13 @@ Yusuke Nojima (@ynojima)
  * Reported #6031: Getter annotated with `@JsonIgnore` prevents `@JsonAlias`
    from working on `@JsonCreator` parameter (regression in 3.2.0)
   [3.2.1]
+
+Théo Szanto (@indyteo)
+ * Reported #6043: `FAIL_ON_UNKNOWN_PROPERTIES` has no effect with `JsonFormat.Shape.ARRAY`
+   when using creator-based instantiation (such as `record`)
+  [3.2.1]
+
+@seonwooj0810
+ * Fixed #6043: `FAIL_ON_UNKNOWN_PROPERTIES` has no effect with `JsonFormat.Shape.ARRAY`
+   when using creator-based instantiation (such as `record`)
+  [3.2.1]

release-notes/VERSION

@@ -21,6 +21,10 @@ No changes since 3.2
   on `@JsonCreator` parameter (regression in 3.2.0)
  (reported by @ynojima)
  (fix by @cowtowncoder, w/ Claude code)
+#6043: `FAIL_ON_UNKNOWN_PROPERTIES` has no effect with `JsonFormat.Shape.ARRAY` when
+  using creator-based instantiation (such as `record`)
+ (reported by Théo S)
+ (fix by @seonwooj0810)
 
 3.2.0 (08-Jun-2026)
 

src/main/java/tools/jackson/databind/deser/bean/BeanAsArrayDeserializer.java

@@ -390,6 +390,18 @@ protected final Object _deserializeUsingPropertyBased(final JsonParser p, final
         for (; p.nextToken() != JsonToken.END_ARRAY; ++i) {
             SettableBeanProperty prop = (i < propCount) ? props[i] : null;
             if (prop == null) { // we get null if there are extra elements; maybe otherwise too?
+                // [databind#6043]: extra JSON Array elements past property count must
+                // honor FAIL_ON_UNKNOWN_PROPERTIES, same as the non-creator path above.
+                // Only genuinely-extra elements (past property count) count as "unknown":
+                // in-bounds null slots (e.g. from renamed/unwrapped properties) are skipped,
+                // matching the non-creator path's position-based check.
+                if (i >= propCount
+                        && !_ignoreAllUnknown && ctxt.isEnabled(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)) {
+                    ctxt.reportWrongTokenException(this, JsonToken.END_ARRAY,
+                            "Unexpected JSON values; expected at most %d properties (in JSON Array)",
+                            propCount);
+                    // never gets here
+                }
                 p.skipChildren();
                 continue;
             }

src/test/java/tools/jackson/databind/struct/POJOAsArrayTest.java

@@ -256,6 +256,10 @@ public CreatorAsArray(@JsonProperty("x") int x, @JsonProperty("y") int y)
         public int getY() { return y; }
     }
 
+    // [databind#6043]
+    @JsonFormat(shape = JsonFormat.Shape.ARRAY)
+    record XYZParams(int x, int y, int z) { }
+
     @JsonFormat(shape=JsonFormat.Shape.ARRAY)
     @JsonPropertyOrder({"a","b","x","y"})
     static class CreatorAsArrayShuffled
@@ -968,4 +972,29 @@ public void testBuilderUnknownExtraProp() throws Exception
         assertEquals(v._x, 2);
         assertEquals(v._y, 3);
     }
+
+    // [databind#6043]: creator-based (e.g. record) POJOs-as-Array must also honor
+    // FAIL_ON_UNKNOWN_PROPERTIES when the JSON Array has more elements than properties
+    @Test
+    public void testCreatorUnknownExtraProp() throws Exception
+    {
+        String json = "[1, 2, 3, 4]";
+        try {
+            MAPPER.readerFor(XYZParams.class)
+                    .with(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                    .readValue(json);
+            fail("should not pass with extra element");
+        } catch (MismatchedInputException e) {
+            verifyException(e, "Unexpected JSON values");
+        }
+
+        // but actually fine if skip-unknown set
+        XYZParams v = MAPPER.readerFor(XYZParams.class)
+                .without(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                .readValue(json);
+        assertNotNull(v);
+        assertEquals(1, v.x());
+        assertEquals(2, v.y());
+        assertEquals(3, v.z());
+    }
 }