diff --git a/src/Symfony/Component/JsonPath/JsonCrawler.php b/src/Symfony/Component/JsonPath/JsonCrawler.php
index 35ad6a93a080c..f9776f21bc14a 100644
--- a/src/Symfony/Component/JsonPath/JsonCrawler.php
+++ b/src/Symfony/Component/JsonPath/JsonCrawler.php
@@ -133,6 +133,14 @@ private function evaluateBracket(string $expr, mixed $value): array
             return [];
         }
 
+        if (str_contains($expr, ',')) {
+            $trimmed = trim($expr);
+            if (str_starts_with($trimmed, ',') || str_ends_with($trimmed, ',')) {
+                throw new JsonCrawlerException($expr, 'Expression cannot have leading or trailing commas');
+            }
+        }
+
+        $expr = JsonPathUtils::normalizeWhitespace($expr);
         if ('*' === $expr) {
             return array_values($value);
         }
@@ -168,8 +176,7 @@ private function evaluateBracket(string $expr, mixed $value): array
             return $result;
         }
 
-        // start, end and step
-        if (preg_match('/^(-?\d*):(-?\d*)(?::(-?\d+))?$/', $expr, $matches)) {
+        if (preg_match('/^(-?\d*+)\s*+:\s*+(-?\d*+)(?:\s*+:\s*+(-?\d++))?$/', $expr, $matches)) {
             if (!array_is_list($value)) {
                 return [];
             }
@@ -217,14 +224,14 @@ private function evaluateBracket(string $expr, mixed $value): array
 
         // filter expressions
         if (preg_match('/^\?(.*)$/', $expr, $matches)) {
-            $filterExpr = $matches[1];
+            $filterExpr = trim($matches[1]);
 
             if (preg_match('/^(\w+)\s*\([^()]*\)\s*([<>=!]+.*)?$/', $filterExpr)) {
                 $filterExpr = "($filterExpr)";
             }
 
             if (!str_starts_with($filterExpr, '(')) {
-                throw new JsonCrawlerException($expr, 'Invalid filter expression');
+                $filterExpr = "($filterExpr)";
             }
 
             // remove outer filter parentheses
@@ -238,28 +245,31 @@ private function evaluateBracket(string $expr, mixed $value): array
             $parts = $this->parseCommaSeparatedValues($expr);
 
             $result = [];
-            $keysIndices = array_keys($value);
-            $isList = array_is_list($value);
 
             foreach ($parts as $part) {
                 $part = trim($part);
 
-                if (preg_match('/^([\'"])(.*)\1$/', $part, $matches)) {
+                if ('*' === $part) {
+                    $result = array_merge($result, array_values($value));
+                } elseif (preg_match('/^(-?\d*+)\s*+:\s*+(-?\d*+)(?:\s*+:\s*+(-?\d++))?$/', $part, $matches)) {
+                    // slice notation
+                    $sliceResult = $this->evaluateBracket($part, $value);
+                    $result = array_merge($result, $sliceResult);
+                } elseif (preg_match('/^([\'"])(.*)\1$/', $part, $matches)) {
                     $key = JsonPathUtils::unescapeString($matches[2], $matches[1]);
 
-                    if ($isList) {
+                    if (array_is_list($value)) {
+                        // for arrays, find ALL objects that contain this key
                         foreach ($value as $item) {
                             if (\is_array($item) && \array_key_exists($key, $item)) {
                                 $result[] = $item;
-                                break;
                             }
                         }
-
-                        continue; // no results here
-                    }
-
-                    if (\array_key_exists($key, $value)) {
-                        $result[] = $value[$key];
+                    } else {
+                        // for objects, get the value for this key
+                        if (\array_key_exists($key, $value)) {
+                            $result[] = $value[$key];
+                        }
                     }
                 } elseif (preg_match('/^-?\d+$/', $part)) {
                     // numeric index
@@ -268,14 +278,14 @@ private function evaluateBracket(string $expr, mixed $value): array
                         $index = \count($value) + $index;
                     }
 
-                    if ($isList && \array_key_exists($index, $value)) {
+                    if (array_is_list($value) && \array_key_exists($index, $value)) {
                         $result[] = $value[$index];
-                        continue;
-                    }
-
-                    // numeric index on a hashmap
-                    if (isset($keysIndices[$index]) && isset($value[$keysIndices[$index]])) {
-                        $result[] = $value[$keysIndices[$index]];
+                    } else {
+                        // numeric index on a hashmap
+                        $keysIndices = array_keys($value);
+                        if (isset($keysIndices[$index]) && isset($value[$keysIndices[$index]])) {
+                            $result[] = $value[$keysIndices[$index]];
+                        }
                     }
                 }
             }
@@ -310,7 +320,32 @@ private function evaluateFilter(string $expr, mixed $value): array
 
     private function evaluateFilterExpression(string $expr, mixed $context): bool
     {
-        $expr = trim($expr);
+        $expr = JsonPathUtils::normalizeWhitespace($expr);
+
+        // remove outer parentheses if they wrap the entire expression
+        if (str_starts_with($expr, '(') && str_ends_with($expr, ')')) {
+            $depth = 0;
+            $isWrapped = true;
+            for ($i = 0; $i < strlen($expr); $i++) {
+                if ($expr[$i] === '(') {
+                    $depth++;
+                } elseif ($expr[$i] === ')') {
+                    $depth--;
+                    if ($depth === 0 && $i < strlen($expr) - 1) {
+                        $isWrapped = false;
+                        break;
+                    }
+                }
+            }
+            if ($isWrapped) {
+                $expr = trim(substr($expr, 1, -1));
+            }
+        }
+
+        if (str_starts_with($expr, '!')) {
+            $innerExpr = trim(substr($expr, 1));
+            return !$this->evaluateFilterExpression($innerExpr, $context);
+        }
 
         if (str_contains($expr, '&&')) {
             $parts = array_map('trim', explode('&&', $expr));
@@ -353,8 +388,8 @@ private function evaluateFilterExpression(string $expr, mixed $context): bool
         }
 
         // function calls
-        if (preg_match('/^(\w+)\((.*)\)$/', $expr, $matches)) {
-            $functionName = $matches[1];
+        if (preg_match('/^(\w++)\s*+\((.*)\)$/', $expr, $matches)) {
+            $functionName = trim($matches[1]);
             if (!isset(self::RFC9535_FUNCTIONS[$functionName])) {
                 throw new JsonCrawlerException($expr, \sprintf('invalid function "%s"', $functionName));
             }
@@ -369,8 +404,15 @@ private function evaluateFilterExpression(string $expr, mixed $context): bool
 
     private function evaluateScalar(string $expr, mixed $context): mixed
     {
-        if (is_numeric($expr)) {
-            return str_contains($expr, '.') ? (float) $expr : (int) $expr;
+        $expr = JsonPathUtils::normalizeWhitespace($expr);
+
+        if (JsonPathUtils::isJsonNumber($expr)) {
+            return str_contains($expr, '.') || str_contains(strtolower($expr), 'e') ? (float) $expr : (int) $expr;
+        }
+
+        // only validate tokens that look like standalone numbers
+        if (preg_match('/^[\d+\-.eE]+$/', $expr) && preg_match('/\d/', $expr)) {
+            throw new JsonCrawlerException($expr, \sprintf('Invalid number format "%s"', $expr));
         }
 
         if ('@' === $expr) {
@@ -404,8 +446,8 @@ private function evaluateScalar(string $expr, mixed $context): mixed
         }
 
         // function calls
-        if (preg_match('/^(\w+)\((.*)\)$/', $expr, $matches)) {
-            $functionName = $matches[1];
+        if (preg_match('/^(\w++)\((.*)\)$/', $expr, $matches)) {
+            $functionName = trim($matches[1]);
             if (!isset(self::RFC9535_FUNCTIONS[$functionName])) {
                 throw new JsonCrawlerException($expr, \sprintf('invalid function "%s"', $functionName));
             }
@@ -416,14 +458,48 @@ private function evaluateScalar(string $expr, mixed $context): mixed
         return null;
     }
 
-    private function evaluateFunction(string $name, string $args, array $context): mixed
+    private function evaluateFunction(string $name, string $args, mixed $context): mixed
     {
-        $args = array_map(
-            fn ($arg) => $this->evaluateScalar(trim($arg), $context),
-            explode(',', $args)
-        );
+        $argList = [];
+        $nodelistSizes = [];
+        if ($args = trim($args)) {
+            $args = $this->parseCommaSeparatedValues($args);
+            foreach ($args as $arg) {
+                $arg = trim($arg);
+                if (str_starts_with($arg, '@')) { // special handling for @ to track nodelist size
+                    if ('@' === $arg) {
+                        $argList[] = $context;
+                        $nodelistSizes[] = 1;
+                    } elseif (!\is_array($context)) {
+                        $argList[] = null;
+                        $nodelistSizes[] = 0;
+                    } else {
+                        $pathPart = substr($arg, 1);
+                        if (str_starts_with($pathPart, '[')) {
+                            // handle bracket expressions like @['a','d']
+                            $results = $this->evaluateBracket(substr($pathPart, 1, -1), $context);
+                            $argList[] = $results;
+                            $nodelistSizes[] = \count($results);
+                        } else {
+                            // handle dot notation like @.a
+                            $results = $this->evaluateTokensOnDecodedData(JsonPathTokenizer::tokenize(new JsonPath('$'.$pathPart)), $context);
+                            $argList[] = $results[0] ?? null;
+                            $nodelistSizes[] = \count($results);
+                        }
+                    }
+                } elseif (str_starts_with($arg, '$')) { // special handling for absolute paths
+                    $results = $this->evaluate(new JsonPath($arg));
+                    $argList[] = $results[0] ?? null;
+                    $nodelistSizes[] = \count($results);
+                } else {
+                    $argList[] = $this->evaluateScalar($arg, $context);
+                    $nodelistSizes[] = 1;
+                }
+            }
+        }
 
-        $value = $args[0] ?? null;
+        $value = $argList[0] ?? null;
+        $nodelistSize = $nodelistSizes[0] ?? 0;
 
         return match ($name) {
             'length' => match (true) {
@@ -431,16 +507,16 @@ private function evaluateFunction(string $name, string $args, array $context): m
                 \is_array($value) => \count($value),
                 default => 0,
             },
-            'count' => \is_array($value) ? \count($value) : 0,
+            'count' => $nodelistSize,
             'match' => match (true) {
-                \is_string($value) && \is_string($args[1] ?? null) => (bool) @preg_match(\sprintf('/^%s$/', $args[1]), $value),
+                \is_string($value) && \is_string($argList[1] ?? null) => (bool) @preg_match(\sprintf('/^%s$/u', $this->transformJsonPathRegex($argList[1])), $value),
                 default => false,
             },
             'search' => match (true) {
-                \is_string($value) && \is_string($args[1] ?? null) => (bool) @preg_match("/$args[1]/", $value),
+                \is_string($value) && \is_string($argList[1] ?? null) => (bool) @preg_match("/{$this->transformJsonPathRegex($argList[1])}/u", $value),
                 default => false,
             },
-            'value' => $value,
+            'value' => 1 < $nodelistSize ? null : (1 === $nodelistSize ? (\is_array($value) ? ($value[0] ?? null) : $value) : $value),
             default => null,
         };
     }
@@ -480,6 +556,7 @@ private function parseCommaSeparatedValues(string $expr): array
         $current = '';
         $inQuotes = false;
         $quoteChar = null;
+        $bracketDepth = 0;
 
         for ($i = 0; $i < \strlen($expr); ++$i) {
             $char = $expr[$i];
@@ -497,7 +574,11 @@ private function parseCommaSeparatedValues(string $expr): array
                     $inQuotes = false;
                     $quoteChar = null;
                 }
-            } elseif (!$inQuotes && ',' === $char) {
+            } elseif (!$inQuotes && '[' === $char) {
+                ++$bracketDepth;
+            } elseif (!$inQuotes && ']' === $char) {
+                --$bracketDepth;
+            } elseif (!$inQuotes && 0 === $bracketDepth && ',' === $char) {
                 $parts[] = trim($current);
                 $current = '';
 
@@ -513,4 +594,53 @@ private function parseCommaSeparatedValues(string $expr): array
 
         return $parts;
     }
+
+    /*
+     * Transform JSONPath regex patterns to comply with RFC 9535. The main issue is
+     * that '.' should not match \r or \n but should match Unicode line
+     * separators U+2028 and U+2029.
+     */
+    private function transformJsonPathRegex(string $pattern): string
+    {
+        $result = '';
+        $inCharClass = false;
+        $escaped = false;
+        $length = strlen($pattern);
+
+        for ($i = 0; $i < $length; $i++) {
+            $char = $pattern[$i];
+
+            if ($escaped) {
+                $result .= $char;
+                $escaped = false;
+                continue;
+            }
+
+            if ($char === '\\') {
+                $result .= $char;
+                $escaped = true;
+                continue;
+            }
+
+            if ($char === '[' && !$inCharClass) {
+                $inCharClass = true;
+                $result .= $char;
+                continue;
+            }
+
+            if ($char === ']' && $inCharClass) {
+                $inCharClass = false;
+                $result .= $char;
+                continue;
+            }
+
+            if ($char === '.' && !$inCharClass) {
+                $result .= '(?:[^\r\n]|\x{2028}|\x{2029})';
+            } else {
+                $result .= $char;
+            }
+        }
+
+        return $result;
+    }
 }
diff --git a/src/Symfony/Component/JsonPath/JsonPathUtils.php b/src/Symfony/Component/JsonPath/JsonPathUtils.php
index 6f971d20115b2..4e13802f982d5 100644
--- a/src/Symfony/Component/JsonPath/JsonPathUtils.php
+++ b/src/Symfony/Component/JsonPath/JsonPathUtils.php
@@ -159,4 +159,26 @@ private static function unescapeUnicodeSequence(string $str, int $length, int &$
 
         return mb_chr($codepoint, 'UTF-8');
     }
+
+    /**
+     * @see https://datatracker.ietf.org/doc/rfc9535/, section 2.1.1
+     */
+    public static function normalizeWhitespace(string $input): string
+    {
+        $normalized = strtr($input, [
+            "\t" => ' ',
+            "\n" => ' ',
+            "\r" => ' ',
+        ]);
+
+        return trim($normalized);
+    }
+
+    /**
+     * Check a number is RFC 9535 compliant using strict JSON number format.
+     */
+    public static function isJsonNumber(string $value): bool
+    {
+        return preg_match('/^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?$/', $value);
+    }
 }
diff --git a/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php b/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php
index a52d586fac869..1d1eb4be3b431 100644
--- a/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php
+++ b/src/Symfony/Component/JsonPath/Tests/JsonCrawlerTest.php
@@ -500,6 +500,28 @@ public function testLengthFunctionWithOuterParentheses()
         $this->assertSame('J. R. R. Tolkien', $result[1]['author']);
     }
 
+    public function testMatchFunctionWithMultipleSpacesTrimmed()
+    {
+        $result = self::getBookstoreCrawler()->find("$.store.book[?(match(@.title, 'Sword   of  Honour'))]");
+
+        $this->assertSame([], $result);
+    }
+
+    public function testFilterMultiline()
+    {
+        $result = self::getBookstoreCrawler()->find(
+            '$
+                    .store
+                    .book[?
+                      length(@.author)>12
+                    ]'
+        );
+
+        $this->assertCount(2, $result);
+        $this->assertSame('Herman Melville', $result[0]['author']);
+        $this->assertSame('J. R. R. Tolkien', $result[1]['author']);
+    }
+
     public function testCountFunction()
     {
         $result = self::getBookstoreCrawler()->find('$.store.book[?count(@.extra) != 0]');
@@ -577,10 +599,6 @@ public static function provideUnicodeEscapeSequencesProvider(): array
                 '$["tab\there"]',
                 ['with tab'],
             ],
-            [
-                '$["new\nline"]',
-                ['with newline'],
-            ],
             [
                 '$["quote\"here"]',
                 ['with quote'],
diff --git a/src/Symfony/Component/JsonPath/Tests/JsonPathComplianceTestSuiteTest.php b/src/Symfony/Component/JsonPath/Tests/JsonPathComplianceTestSuiteTest.php
index 82db371500e0a..da0a433b3f2e8 100644
--- a/src/Symfony/Component/JsonPath/Tests/JsonPathComplianceTestSuiteTest.php
+++ b/src/Symfony/Component/JsonPath/Tests/JsonPathComplianceTestSuiteTest.php
@@ -18,7 +18,6 @@
 final class JsonPathComplianceTestSuiteTest extends TestCase
 {
     private const UNSUPPORTED_TEST_CASES = [
-        'basic, multiple selectors, name and index, array data',
         'basic, multiple selectors, name and index, object data',
         'basic, multiple selectors, index and slice',
         'basic, multiple selectors, index and slice, overlapping',
@@ -27,22 +26,11 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'basic, multiple selectors, wildcard and slice',
         'basic, multiple selectors, multiple wildcards',
         'filter, existence, without segments',
-        'filter, existence',
         'filter, existence, present with null',
         'filter, absolute existence, without segments',
         'filter, absolute existence, with segments',
-        'filter, equals string, single quotes',
-        'filter, equals numeric string, single quotes',
-        'filter, equals string, double quotes',
-        'filter, equals numeric string, double quotes',
-        'filter, equals number',
-        'filter, equals null',
         'filter, equals null, absent from data',
-        'filter, equals true',
-        'filter, equals false',
-        'filter, equals self',
         'filter, absolute, equals self',
-        'filter, equals, absent from index selector equals absent from name selector',
         'filter, deep equality, arrays',
         'filter, deep equality, objects',
         'filter, not-equals string, single quotes',
@@ -51,26 +39,12 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'filter, not-equals string, double quotes',
         'filter, not-equals numeric string, double quotes',
         'filter, not-equals string, double quotes, different types',
-        'filter, not-equals number',
-        'filter, not-equals number, different types',
-        'filter, not-equals null',
         'filter, not-equals null, absent from data',
-        'filter, not-equals true',
-        'filter, not-equals false',
-        'filter, less than string, single quotes',
-        'filter, less than string, double quotes',
         'filter, less than number',
         'filter, less than null',
         'filter, less than true',
         'filter, less than false',
-        'filter, less than or equal to string, single quotes',
-        'filter, less than or equal to string, double quotes',
-        'filter, less than or equal to number',
-        'filter, less than or equal to null',
         'filter, less than or equal to true',
-        'filter, less than or equal to false',
-        'filter, greater than string, single quotes',
-        'filter, greater than string, double quotes',
         'filter, greater than number',
         'filter, greater than null',
         'filter, greater than true',
@@ -86,8 +60,6 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'filter, exists or exists, data false',
         'filter, and',
         'filter, or',
-        'filter, not expression',
-        'filter, not exists',
         'filter, not exists, data null',
         'filter, non-singular existence, wildcard',
         'filter, non-singular existence, multiple',
@@ -129,10 +101,6 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'filter, and binds more tightly than or',
         'filter, left to right evaluation',
         'filter, group terms, right',
-        'filter, string literal, single quote in double quotes',
-        'filter, string literal, double quote in single quotes',
-        'filter, string literal, escaped single quote in single quotes',
-        'filter, string literal, escaped double quote in double quotes',
         'name selector, double quotes, escaped reverse solidus',
         'name selector, single quotes, escaped reverse solidus',
         'slice selector, slice selector with everything omitted, long form',
@@ -140,130 +108,7 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'slice selector, start, max exact',
         'slice selector, end, min exact',
         'slice selector, end, max exact',
-        'functions, length, arg is special nothing',
-        'functions, match, don\'t select match',
-        'functions, match, select non-match',
-        'functions, match, arg is a function expression',
-        'functions, search, don\'t select match',
-        'functions, search, select non-match',
-        'functions, search, arg is a function expression',
-        'whitespace, filter, space between question mark and expression',
-        'whitespace, filter, newline between question mark and expression',
-        'whitespace, filter, tab between question mark and expression',
-        'whitespace, filter, return between question mark and expression',
-        'whitespace, filter, space between question mark and parenthesized expression',
-        'whitespace, filter, newline between question mark and parenthesized expression',
-        'whitespace, filter, tab between question mark and parenthesized expression',
-        'whitespace, filter, return between question mark and parenthesized expression',
-        'whitespace, filter, space between bracket and question mark',
-        'whitespace, filter, newline between bracket and question mark',
-        'whitespace, filter, tab between bracket and question mark',
-        'whitespace, filter, return between bracket and question mark',
-        'whitespace, functions, newline between parenthesis and arg',
-        'whitespace, functions, newline between arg and comma',
-        'whitespace, functions, newline between comma and arg',
-        'whitespace, functions, newline between arg and parenthesis',
-        'whitespace, functions, newlines in a relative singular selector',
-        'whitespace, functions, newlines in an absolute singular selector',
-        'whitespace, operators, space before ||',
-        'whitespace, operators, newline before ||',
-        'whitespace, operators, tab before ||',
-        'whitespace, operators, return before ||',
-        'whitespace, operators, space after ||',
-        'whitespace, operators, newline after ||',
-        'whitespace, operators, tab after ||',
-        'whitespace, operators, return after ||',
-        'whitespace, operators, space before &&',
-        'whitespace, operators, newline before &&',
-        'whitespace, operators, tab before &&',
-        'whitespace, operators, return before &&',
-        'whitespace, operators, space after &&',
-        'whitespace, operators, newline after &&',
-        'whitespace, operators, tab after &&',
-        'whitespace, operators, return after &&',
-        'whitespace, operators, space before ==',
-        'whitespace, operators, newline before ==',
-        'whitespace, operators, tab before ==',
-        'whitespace, operators, return before ==',
-        'whitespace, operators, space after ==',
-        'whitespace, operators, newline after ==',
-        'whitespace, operators, tab after ==',
-        'whitespace, operators, return after ==',
-        'whitespace, operators, space before !=',
-        'whitespace, operators, newline before !=',
-        'whitespace, operators, tab before !=',
-        'whitespace, operators, return before !=',
-        'whitespace, operators, space after !=',
-        'whitespace, operators, newline after !=',
-        'whitespace, operators, tab after !=',
-        'whitespace, operators, return after !=',
-        'whitespace, operators, space before <',
-        'whitespace, operators, newline before <',
-        'whitespace, operators, tab before <',
-        'whitespace, operators, return before <',
-        'whitespace, operators, space after <',
-        'whitespace, operators, newline after <',
-        'whitespace, operators, tab after <',
-        'whitespace, operators, return after <',
-        'whitespace, operators, space before >',
-        'whitespace, operators, newline before >',
-        'whitespace, operators, tab before >',
-        'whitespace, operators, return before >',
-        'whitespace, operators, space after >',
-        'whitespace, operators, newline after >',
-        'whitespace, operators, tab after >',
-        'whitespace, operators, return after >',
-        'whitespace, operators, space before <=',
-        'whitespace, operators, newline before <=',
-        'whitespace, operators, tab before <=',
-        'whitespace, operators, return before <=',
-        'whitespace, operators, space after <=',
-        'whitespace, operators, newline after <=',
-        'whitespace, operators, tab after <=',
-        'whitespace, operators, return after <=',
-        'whitespace, operators, space before >=',
-        'whitespace, operators, newline before >=',
-        'whitespace, operators, tab before >=',
-        'whitespace, operators, return before >=',
-        'whitespace, operators, space after >=',
-        'whitespace, operators, newline after >=',
-        'whitespace, operators, tab after >=',
-        'whitespace, operators, return after >=',
-        'whitespace, operators, space between logical not and test expression',
-        'whitespace, operators, newline between logical not and test expression',
-        'whitespace, operators, tab between logical not and test expression',
-        'whitespace, operators, return between logical not and test expression',
-        'whitespace, operators, space between logical not and parenthesized expression',
-        'whitespace, operators, newline between logical not and parenthesized expression',
-        'whitespace, operators, tab between logical not and parenthesized expression',
-        'whitespace, operators, return between logical not and parenthesized expression',
-        'whitespace, selectors, space between bracket and selector',
-        'whitespace, selectors, newline between bracket and selector',
-        'whitespace, selectors, tab between bracket and selector',
-        'whitespace, selectors, return between bracket and selector',
-        'whitespace, selectors, space between selector and bracket',
-        'whitespace, selectors, tab between selector and bracket',
-        'whitespace, selectors, return between selector and bracket',
-        'whitespace, selectors, newline between selector and comma',
-        'whitespace, selectors, newline between comma and selector',
-        'whitespace, slice, space between start and colon',
-        'whitespace, slice, newline between start and colon',
-        'whitespace, slice, tab between start and colon',
-        'whitespace, slice, return between start and colon',
-        'whitespace, slice, space between colon and end',
-        'whitespace, slice, newline between colon and end',
-        'whitespace, slice, tab between colon and end',
-        'whitespace, slice, return between colon and end',
-        'whitespace, slice, space between end and colon',
-        'whitespace, slice, newline between end and colon',
-        'whitespace, slice, tab between end and colon',
-        'whitespace, slice, return between end and colon',
-        'whitespace, slice, space between colon and step',
-        'whitespace, slice, newline between colon and step',
-        'whitespace, slice, tab between colon and step',
-        'whitespace, slice, return between colon and step',
         'basic, descendant segment, multiple selectors',
-        'basic, descendant segment, object traversal, multiple selectors',
         'basic, bald descendant segment',
         'filter, relative non-singular query, index, equal',
         'filter, relative non-singular query, index, not equal',
@@ -334,17 +179,7 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'name selector, double quotes, embedded U+001D',
         'name selector, double quotes, embedded U+001E',
         'name selector, double quotes, embedded U+001F',
-        'name selector, double quotes, escaped backspace',
-        'name selector, double quotes, escaped form feed',
         'name selector, double quotes, escaped line feed',
-        'name selector, double quotes, escaped carriage return',
-        'name selector, double quotes, escaped tab',
-        'name selector, double quotes, escaped ☺, upper case hex',
-        'name selector, double quotes, escaped ☺, lower case hex',
-        'name selector, double quotes, surrogate pair 𝄞',
-        'name selector, double quotes, surrogate pair 😀',
-        'name selector, double quotes, before high surrogates',
-        'name selector, double quotes, after low surrogates',
         'name selector, double quotes, invalid escaped single quote',
         'name selector, double quotes, question mark escape',
         'name selector, double quotes, bell escape',
@@ -400,14 +235,7 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'name selector, single quotes, embedded U+001E',
         'name selector, single quotes, embedded U+001F',
         'name selector, single quotes, escaped backspace',
-        'name selector, single quotes, escaped form feed',
         'name selector, single quotes, escaped line feed',
-        'name selector, single quotes, escaped carriage return',
-        'name selector, single quotes, escaped tab',
-        'name selector, single quotes, escaped ☺, upper case hex',
-        'name selector, single quotes, escaped ☺, lower case hex',
-        'name selector, single quotes, surrogate pair 𝄞',
-        'name selector, single quotes, surrogate pair 😀',
         'name selector, single quotes, invalid escaped double quote',
         'slice selector, excessively large from value with negative step',
         'slice selector, step, min exact - 1',
@@ -421,99 +249,6 @@ final class JsonPathComplianceTestSuiteTest extends TestCase
         'slice selector, step, leading 0',
         'slice selector, step, -0',
         'slice selector, step, leading -0',
-        'functions, count, count function',
-        'functions, count, single-node arg',
-        'functions, count, multiple-selector arg',
-        'functions, count, non-query arg, number',
-        'functions, count, non-query arg, string',
-        'functions, count, non-query arg, true',
-        'functions, count, non-query arg, false',
-        'functions, count, non-query arg, null',
-        'functions, count, result must be compared',
-        'functions, count, no params',
-        'functions, count, too many params',
-        'functions, length, string data, unicode',
-        'functions, length, result must be compared',
-        'functions, length, no params',
-        'functions, length, too many params',
-        'functions, length, non-singular query arg',
-        'functions, length, arg is a function expression',
-        'functions, match, regex from the document',
-        'functions, match, filter, match function, unicode char class, uppercase',
-        'functions, match, filter, match function, unicode char class negated, uppercase',
-        'functions, match, filter, match function, unicode, surrogate pair',
-        'functions, match, dot matcher on \u2028',
-        'functions, match, dot matcher on \u2029',
-        'functions, match, result cannot be compared',
-        'functions, match, too few params',
-        'functions, match, too many params',
-        'functions, match, dot in character class',
-        'functions, match, escaped dot',
-        'functions, match, escaped backslash before dot',
-        'functions, match, escaped left square bracket',
-        'functions, match, escaped right square bracket',
-        'functions, match, explicit caret',
-        'functions, match, explicit dollar',
-        'functions, search, regex from the document',
-        'functions, search, filter, search function, unicode char class, uppercase',
-        'functions, search, filter, search function, unicode char class negated, uppercase',
-        'functions, search, filter, search function, unicode, surrogate pair',
-        'functions, search, dot matcher on \u2028',
-        'functions, search, dot matcher on \u2029',
-        'functions, search, result cannot be compared',
-        'functions, search, too few params',
-        'functions, search, too many params',
-        'functions, search, dot in character class',
-        'functions, search, escaped dot',
-        'functions, search, escaped backslash before dot',
-        'functions, search, escaped left square bracket',
-        'functions, search, escaped right square bracket',
-        'functions, value, single-value nodelist',
-        'functions, value, too few params',
-        'functions, value, too many params',
-        'functions, value, result must be compared',
-        'whitespace, filter, space between parenthesized expression and bracket',
-        'whitespace, filter, tab between parenthesized expression and bracket',
-        'whitespace, filter, return between parenthesized expression and bracket',
-        'whitespace, functions, space between function name and parenthesis',
-        'whitespace, functions, tab between function name and parenthesis',
-        'whitespace, functions, return between function name and parenthesis',
-        'whitespace, functions, space between parenthesis and arg',
-        'whitespace, functions, tab between parenthesis and arg',
-        'whitespace, functions, return between parenthesis and arg',
-        'whitespace, functions, space between arg and comma',
-        'whitespace, functions, tab between arg and comma',
-        'whitespace, functions, return between arg and comma',
-        'whitespace, functions, space between comma and arg',
-        'whitespace, functions, tab between comma and arg',
-        'whitespace, functions, return between comma and arg',
-        'whitespace, functions, space between arg and parenthesis',
-        'whitespace, functions, tab between arg and parenthesis',
-        'whitespace, functions, return between arg and parenthesis',
-        'whitespace, functions, spaces in a relative singular selector',
-        'whitespace, functions, tabs in a relative singular selector',
-        'whitespace, functions, returns in a relative singular selector',
-        'whitespace, functions, spaces in an absolute singular selector',
-        'whitespace, functions, tabs in an absolute singular selector',
-        'whitespace, functions, returns in an absolute singular selector',
-        'whitespace, selectors, space between root and bracket',
-        'whitespace, selectors, newline between root and bracket',
-        'whitespace, selectors, tab between root and bracket',
-        'whitespace, selectors, return between root and bracket',
-        'whitespace, selectors, space between bracket and bracket',
-        'whitespace, selectors, newline between bracket and bracket',
-        'whitespace, selectors, tab between bracket and bracket',
-        'whitespace, selectors, return between bracket and bracket',
-        'whitespace, selectors, space between root and dot',
-        'whitespace, selectors, newline between root and dot',
-        'whitespace, selectors, tab between root and dot',
-        'whitespace, selectors, return between root and dot',
-        'whitespace, selectors, space between selector and comma',
-        'whitespace, selectors, tab between selector and comma',
-        'whitespace, selectors, return between selector and comma',
-        'whitespace, selectors, space between comma and selector',
-        'whitespace, selectors, tab between comma and selector',
-        'whitespace, selectors, return between comma and selector',
     ];
 
     /**
diff --git a/src/Symfony/Component/JsonPath/Tests/Tokenizer/JsonPathTokenizerTest.php b/src/Symfony/Component/JsonPath/Tests/Tokenizer/JsonPathTokenizerTest.php
index b6768ff7ac9db..fdbd36d3cbc36 100644
--- a/src/Symfony/Component/JsonPath/Tests/Tokenizer/JsonPathTokenizerTest.php
+++ b/src/Symfony/Component/JsonPath/Tests/Tokenizer/JsonPathTokenizerTest.php
@@ -355,9 +355,7 @@ public static function provideInvalidUtf8PropertyName(): array
             'special char first' => ['#test'],
             'start with digit' => ['123test'],
             'asterisk' => ['test*test'],
-            'space not allowed' => [' test'],
             'at sign not allowed' => ['@test'],
-            'start control char' => ["\0test"],
             'ending control char' => ["test\xFF\xFA"],
             'dash sign' => ['-test'],
         ];
diff --git a/src/Symfony/Component/JsonPath/Tokenizer/JsonPathTokenizer.php b/src/Symfony/Component/JsonPath/Tokenizer/JsonPathTokenizer.php
index d7c5fe44457e7..cbc4366b95c9c 100644
--- a/src/Symfony/Component/JsonPath/Tokenizer/JsonPathTokenizer.php
+++ b/src/Symfony/Component/JsonPath/Tokenizer/JsonPathTokenizer.php
@@ -21,6 +21,9 @@
  */
 final class JsonPathTokenizer
 {
+    private const RFC9535_WHITESPACE_CHARS = [' ', "\t", "\n", "\r"];
+    private const BARE_LITERAL_REGEX = '(true|false|null|\d+(\.\d+)?([eE][+-]?\d+)?|\'[^\']*\'|"[^"]*")';
+
     /**
      * @return JsonPathToken[]
      */
@@ -34,6 +37,8 @@ public static function tokenize(JsonPath $query): array
         $inQuote = false;
         $quoteChar = '';
         $filterParenthesisDepth = 0;
+        $filterBracketDepth = 0;
+        $hasContentAfterRoot = false;
 
         $chars = mb_str_split((string) $query);
         $length = \count($chars);
@@ -42,14 +47,36 @@ public static function tokenize(JsonPath $query): array
             throw new InvalidJsonPathException('empty JSONPath expression.');
         }
 
-        if ('$' !== $chars[0]) {
+        $i = self::skipWhitespace($chars, 0, $length);
+        if ($i >= $length || '$' !== $chars[$i]) {
             throw new InvalidJsonPathException('expression must start with $.');
         }
 
+        $rootIndex = $i;
+        if ($rootIndex + 1 < $length) {
+            $hasContentAfterRoot = true;
+        }
+
         for ($i = 0; $i < $length; ++$i) {
             $char = $chars[$i];
             $position = $i;
 
+            if (!$inQuote && !$inBracket && self::isWhitespace($char)) {
+                if ('' !== $current) {
+                    $tokens[] = new JsonPathToken(TokenType::Name, $current);
+                    $current = '';
+                }
+
+                $nextNonWhitespaceIndex = self::skipWhitespace($chars, $i, $length);
+                if ($nextNonWhitespaceIndex < $length && '[' !== $chars[$nextNonWhitespaceIndex] && '.' !== $chars[$nextNonWhitespaceIndex]) {
+                    throw new InvalidJsonPathException('whitespace is not allowed in property names.', $i);
+                }
+
+                $i = $nextNonWhitespaceIndex - 1;
+
+                continue;
+            }
+
             if (('"' === $char || "'" === $char) && !$inQuote) {
                 $inQuote = true;
                 $quoteChar = $char;
@@ -58,8 +85,16 @@ public static function tokenize(JsonPath $query): array
             }
 
             if ($inQuote) {
+                if ($inBracket && "\n" === $char) {
+                    throw new InvalidJsonPathException('newlines are not allowed in quoted strings.', $position);
+                }
+
+                if ($inBracket && 'n' === $char && $i > 0 && '\\' === $chars[$i - 1]) {
+                    throw new InvalidJsonPathException('escaped newlines are not allowed in quoted strings.', $position);
+                }
+
                 $current .= $char;
-                if ($char === $quoteChar && '\\' !== $chars[$i - 1]) {
+                if ($char === $quoteChar && (0 === $i || '\\' !== $chars[$i - 1])) {
                     $inQuote = false;
                 }
                 if ($i === $length - 1 && $inQuote) {
@@ -80,11 +115,22 @@ public static function tokenize(JsonPath $query): array
 
                 $inBracket = true;
                 ++$bracketDepth;
+                $i = self::skipWhitespace($chars, $i + 1, $length) - 1; // -1 because loop will increment
+
+                continue;
+            }
+
+            if ('[' === $char && $inFilter) {
+                // inside filter expressions, brackets are part of the filter content
+                ++$filterBracketDepth;
+                $current .= $char;
                 continue;
             }
 
             if (']' === $char) {
-                if ($inFilter && $filterParenthesisDepth > 0) {
+                if ($inFilter && $filterBracketDepth > 0) {
+                    // inside filter expressions, brackets are part of the filter content
+                    --$filterBracketDepth;
                     $current .= $char;
                     continue;
                 }
@@ -94,35 +140,61 @@ public static function tokenize(JsonPath $query): array
                 }
 
                 if (0 === $bracketDepth) {
-                    if ('' === $current) {
+                    if ('' === $current = trim($current)) {
                         throw new InvalidJsonPathException('empty brackets are not allowed.', $position);
                     }
 
+                    // validate filter expressions
+                    if (str_starts_with($current, '?')) {
+                        if ($filterParenthesisDepth > 0) {
+                            throw new InvalidJsonPathException('unclosed bracket.', $position);
+                        }
+                        self::validateFilterExpression($current, $position);
+                    }
+
                     $tokens[] = new JsonPathToken(TokenType::Bracket, $current);
                     $current = '';
                     $inBracket = false;
                     $inFilter = false;
                     $filterParenthesisDepth = 0;
+                    $filterBracketDepth = 0;
                     continue;
                 }
             }
 
             if ('?' === $char && $inBracket && !$inFilter) {
-                if ('' !== $current) {
+                if ('' !== trim($current)) {
                     throw new InvalidJsonPathException('unexpected characters before filter expression.', $position);
                 }
+
+                $current = '?';
                 $inFilter = true;
                 $filterParenthesisDepth = 0;
+                $filterBracketDepth = 0;
+
+                continue;
             }
 
             if ($inFilter) {
                 if ('(' === $char) {
+                    if (preg_match('/\w\s+$/', $current)) {
+                        throw new InvalidJsonPathException('whitespace is not allowed between function name and parenthesis.', $position);
+                    }
                     ++$filterParenthesisDepth;
                 } elseif (')' === $char) {
                     if (--$filterParenthesisDepth < 0) {
                         throw new InvalidJsonPathException('unmatched closing parenthesis in filter.', $position);
                     }
                 }
+                $current .= $char;
+
+                continue;
+            }
+
+            if ($inBracket && self::isWhitespace($char)) {
+                $current .= $char;
+
+                continue;
             }
 
             // recursive descent
@@ -158,7 +230,7 @@ public static function tokenize(JsonPath $query): array
             throw new InvalidJsonPathException('unclosed string literal.', $length - 1);
         }
 
-        if ('' !== $current) {
+        if ('' !== $current = trim($current)) {
             // final validation of the whole name
             if (!preg_match('/^(?:\*|[a-zA-Z_\x{0080}-\x{D7FF}\x{E000}-\x{10FFFF}][a-zA-Z0-9_\x{0080}-\x{D7FF}\x{E000}-\x{10FFFF}]*)$/u', $current)) {
                 throw new InvalidJsonPathException(\sprintf('invalid character in property name "%s"', $current));
@@ -167,6 +239,237 @@ public static function tokenize(JsonPath $query): array
             $tokens[] = new JsonPathToken(TokenType::Name, $current);
         }
 
+        if ($hasContentAfterRoot && !$tokens) {
+            throw new InvalidJsonPathException('invalid JSONPath expression.');
+        }
+
         return $tokens;
     }
+
+    private static function isWhitespace(string $char): bool
+    {
+        return \in_array($char, self::RFC9535_WHITESPACE_CHARS, true);
+    }
+
+    private static function skipWhitespace(array $chars, int $index, int $length): int
+    {
+        while ($index < $length && self::isWhitespace($chars[$index])) {
+            ++$index;
+        }
+
+        return $index;
+    }
+
+    private static function validateFilterExpression(string $expr, int $position): void
+    {
+        self::validateBareLiterals($expr, $position);
+
+        $filterExpr = ltrim($expr, '?');
+        $filterExpr = trim($filterExpr);
+
+        $comparisonOps = ['==', '!=', '>=', '<=', '>', '<'];
+        foreach ($comparisonOps as $op) {
+            if (str_contains($filterExpr, $op)) {
+                [$left, $right] = array_map('trim', explode($op, $filterExpr, 2));
+
+                // check if either side contains non-singular queries
+                if (self::isNonSingularQuery($left) || self::isNonSingularQuery($right)) {
+                    throw new InvalidJsonPathException('Non-singular query is not comparable.', $position);
+                }
+
+                break;
+            }
+        }
+
+        // look for invalid number formats in filter expressions
+        $operators = [...$comparisonOps, '&&', '||'];
+        $tokens = [$filterExpr];
+
+        foreach ($operators as $op) {
+            $newTokens = [];
+            foreach ($tokens as $token) {
+                $newTokens = array_merge($newTokens, explode($op, $token));
+            }
+
+            $tokens = $newTokens;
+        }
+
+        foreach ($tokens as $token) {
+            $token = trim($token);
+            if ('' === $token) continue;
+
+            if (str_starts_with($token, '@') || str_starts_with($token, '"') || str_starts_with($token, "'")) {
+                continue;
+            }
+
+            if (in_array($token, ['true', 'false', 'null'], true)) {
+                continue;
+            }
+
+            if (str_contains($token, '(') || str_contains($token, ')')) {
+                continue;
+            }
+
+            // allow number-like tokens with dots: .1, -.1, 1., 1.2, 1.e1, etc.
+            if (str_contains($token, '.') && !preg_match('/^[\d+\-.eE\s]*\./', $token)) {
+                continue;
+            }
+            if (str_contains($token, '[') || str_contains($token, ']')) {
+                continue;
+            }
+
+            if (str_contains($token, '$')) {
+                continue;
+            }
+
+            if (preg_match('/^[\d+\-.eE\s]+$/', $token) && preg_match('/\d/', $token)) {
+                // strict JSON number format validation
+                if (!preg_match('/^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?$/', $token)) {
+                    throw new InvalidJsonPathException(\sprintf('Invalid number format "%s" in filter expression.', $token), $position);
+                }
+            }
+        }
+    }
+
+    private static function validateBareLiterals(string $expr, int $position): void
+    {
+        $filterExpr = ltrim($expr, '?');
+        $filterExpr = trim($filterExpr);
+
+        if (preg_match('/\b(True|False|Null)\b/', $filterExpr)) {
+            throw new InvalidJsonPathException('Incorrectly capitalized literal in filter expression.', $position);
+        }
+
+        if (preg_match('/^(length|count|value)\s*\([^)]*\)$/', $filterExpr)) {
+            throw new InvalidJsonPathException('Function result must be compared.', $position);
+        }
+
+        if (preg_match('/\b(length|count|value)\s*\(([^)]*)\)/', $filterExpr, $matches)) {
+            $functionName = $matches[1];
+            $args = trim($matches[2]);
+            if (empty($args)) {
+                throw new InvalidJsonPathException('Function requires exactly one argument.', $position);
+            }
+
+            $argParts = self::parseArguments($args);
+            if (count($argParts) !== 1) {
+                throw new InvalidJsonPathException('Function requires exactly one argument.', $position);
+            }
+
+            $arg = trim($argParts[0]);
+
+            if ('count' === $functionName && preg_match('/^'.self::BARE_LITERAL_REGEX.'$/', $arg)) {
+                throw new InvalidJsonPathException('count() function requires a query argument, not a literal.', $position);
+            }
+
+            if ('length' === $functionName && preg_match('/@\.\*/', $arg)) {
+                throw new InvalidJsonPathException('Function argument must be a singular query.', $position);
+            }
+        }
+
+        if (preg_match('/\b(match|search)\s*\(([^)]*)\)/', $filterExpr, $matches)) {
+            $args = trim($matches[2]);
+            if (empty($args)) {
+                throw new InvalidJsonPathException('Function requires exactly two arguments.', $position);
+            }
+
+            $argParts = self::parseArguments($args);
+            if (count($argParts) !== 2) {
+                throw new InvalidJsonPathException('Function requires exactly two arguments.', $position);
+            }
+        }
+
+        if (preg_match('/^'.self::BARE_LITERAL_REGEX.'$/', $filterExpr)) {
+            throw new InvalidJsonPathException('Bare literal in filter expression - literals must be compared.', $position);
+        }
+
+        if (preg_match('/\b'.self::BARE_LITERAL_REGEX.'\s*(&&|\|\|)\s*'.self::BARE_LITERAL_REGEX.'\b/', $filterExpr)) {
+            throw new InvalidJsonPathException('Bare literals in logical expression - literals must be compared.', $position);
+        }
+
+        if (preg_match('/\b(match|search|length|count|value)\s*\([^)]*\)\s*[=!]=\s*(true|false)\b/', $filterExpr) ||
+            preg_match('/\b(true|false)\s*[=!]=\s*(match|search|length|count|value)\s*\([^)]*\)/', $filterExpr)) {
+            throw new InvalidJsonPathException('Function result cannot be compared to boolean literal.', $position);
+        }
+
+        if (preg_match('/\b'.self::BARE_LITERAL_REGEX.'\s*(&&|\|\|)/', $filterExpr) ||
+            preg_match('/(&&|\|\|)\s*'.self::BARE_LITERAL_REGEX.'\b/', $filterExpr)) {
+            // check if the literal is not part of a comparison
+            if (!preg_match('/(@[^=<>!]*|[^=<>!@]+)\s*[=<>!]+\s*'.self::BARE_LITERAL_REGEX.'/', $filterExpr) &&
+                !preg_match('/'.self::BARE_LITERAL_REGEX.'\s*[=<>!]+\s*(@[^=<>!]*|[^=<>!@]+)/', $filterExpr)) {
+                throw new InvalidJsonPathException('Bare literal in logical expression - literals must be compared.', $position);
+            }
+        }
+    }
+
+    private static function parseArguments(string $args): array
+    {
+        $parts = [];
+        $current = '';
+        $inQuotes = false;
+        $quoteChar = null;
+        $bracketDepth = 0;
+
+        for ($i = 0; $i < strlen($args); ++$i) {
+            $char = $args[$i];
+
+            if ('\\' === $char && $i + 1 < strlen($args)) {
+                $current .= $char.$args[++$i];
+                continue;
+            }
+
+            if ('"' === $char || "'" === $char) {
+                if (!$inQuotes) {
+                    $inQuotes = true;
+                    $quoteChar = $char;
+                } elseif ($char === $quoteChar) {
+                    $inQuotes = false;
+                    $quoteChar = null;
+                }
+            } elseif (!$inQuotes && '[' === $char) {
+                ++$bracketDepth;
+            } elseif (!$inQuotes && ']' === $char) {
+                --$bracketDepth;
+            } elseif (!$inQuotes && 0 === $bracketDepth && ',' === $char) {
+                $parts[] = trim($current);
+                $current = '';
+                continue;
+            }
+
+            $current .= $char;
+        }
+
+        if ('' !== $current) {
+            $parts[] = trim($current);
+        }
+
+        return $parts;
+    }
+
+    private static function isNonSingularQuery(string $query): bool
+    {
+        $query = trim($query);
+
+        if (!str_starts_with($query, '@')) {
+            return false;
+        }
+
+        if (preg_match('/@\.\./', $query)) {
+            return true;
+        }
+
+        if (preg_match('/@.*\[\*\]/', $query) || preg_match('/@.*\.\*/', $query)) {
+            return true;
+        }
+
+        if (preg_match('/@.*\[.*:.*\]/', $query)) {
+            return true;
+        }
+
+        if (preg_match('/@.*\[.*,.*\]/', $query)) {
+            return true;
+        }
+
+        return false;
+    }
 }