Fastjson vulnerabilities

3 known vulnerabilities in Fastjson from Alibaba. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83.

  CVE-2026-16723Jul 23, 2026Alibaba

  A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

• 10.0 Critical severity

  Fastjson: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2025-70974Jan 9, 2026Alibaba

  Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there ma

• 9.8 Critical severity

  com.alibaba:fastjson: Deserialization of Untrusted Data

  CVE-2022-25845Jun 10, 2022Com.alibaba:fastjsonEPSS 18.7%

  The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote server