Skip to content

Product

Alibaba Fastjson vulnerabilities

4 published CVES affecting Alibaba Fastjson, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
4
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest Alibaba Fastjson CVEs

Newest publication first

  1. CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83

    Published
    CriticalCVSS 9.0 EPSS 0.66%

    A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

  2. CVE-2025-70974 FASTJSON Includes Functionality from Untrusted Control Sphere

    Published
    CriticalCVSS 10.0 EPSS 0.75%

    Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection...

  3. CVE-2022-25845 Deserialization of Untrusted Data

    Published
    CriticalCVSS 9.8 EPSS 18.7%

    The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If up...

  4. CVE-2017-18349 Improper Input Validation in alilibaba:fastjson

    Published
    CriticalCVSS 9.8 EPSS 38.8%

    parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /j...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.