All vulnerabilities
CVE-2025-70974GHSA-jm7w-5684-pvh8

com.alibaba:fastjson: FASTJSON Includes Functionality from Untrusted Control Sphere

Alibaba com.alibaba:fastjsonmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 9 Jan 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.76%Chance of exploitation activity in the next 30 days, higher than 54% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.48Fixed versionGitHub
Published9 Jan 2026Updated 5 Oct 2026CVE List

What fixes it

  • 1.2.48com.alibaba:fastjson, mavenGitHub<dependency><groupId>com.alibaba</groupId><artifactId>fastjson</artifactId><version>1.2.48</version></dependency>
  • 1.2.48FastjsonCVE List
  • 1.2.48com.alibaba:fastjson, MavenOSV<dependency><groupId>com.alibaba</groupId><artifactId>fastjson</artifactId><version>1.2.48</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

Text from CVE List

Affected versions 53

  • com.alibaba:fastjson, maven< 1.2.48GitHub
  • Fastjsonaffected: all versions before 1.2.48CVE List
  • com.alibaba:fastjson, Mavenfrom first release, fixed in 1.2.48OSV
  • com.alibaba:fastjson, Maven1.1.15OSV
  • com.alibaba:fastjson, Maven1.1.16OSV
  • com.alibaba:fastjson, Maven1.1.17OSV
  • com.alibaba:fastjson, Maven1.1.18OSV
  • com.alibaba:fastjson, Maven1.1.19OSV
  • com.alibaba:fastjson, Maven1.1.20OSV
  • com.alibaba:fastjson, Maven1.1.21OSV
  • com.alibaba:fastjson, Maven1.1.22OSV
  • com.alibaba:fastjson, Maven1.1.23OSV
  • com.alibaba:fastjson, Maven1.1.24OSV
  • com.alibaba:fastjson, Maven1.1.25OSV
  • com.alibaba:fastjson, Maven1.1.26OSV
  • com.alibaba:fastjson, Maven1.1.27OSV
  • com.alibaba:fastjson, Maven1.1.28OSV
  • com.alibaba:fastjson, Maven1.1.29OSV
  • com.alibaba:fastjson, Maven1.1.30OSV
  • com.alibaba:fastjson, Maven1.1.31OSV
  • com.alibaba:fastjson, Maven1.1.31.sec01OSV
  • com.alibaba:fastjson, Maven1.1.31.sec04OSV
  • com.alibaba:fastjson, Maven1.1.31.sec06OSV
  • com.alibaba:fastjson, Maven1.1.31.sec07OSV
  • com.alibaba:fastjson, Maven1.1.31.sec10OSV
  • com.alibaba:fastjson, Maven1.1.31_noneautotypeOSV
  • com.alibaba:fastjson, Maven1.1.32OSV
  • com.alibaba:fastjson, Maven1.1.33OSV
  • com.alibaba:fastjson, Maven1.1.33.androidOSV
  • com.alibaba:fastjson, Maven1.1.33.sec01OSV
  • com.alibaba:fastjson, Maven1.1.33.sec04OSV
  • com.alibaba:fastjson, Maven1.1.33.sec06OSV
  • com.alibaba:fastjson, Maven1.1.33.sec10OSV
  • com.alibaba:fastjson, Maven1.1.34OSV
  • com.alibaba:fastjson, Maven1.1.34.androidOSV
  • com.alibaba:fastjson, Maven1.1.34.sec01OSV
  • com.alibaba:fastjson, Maven1.1.34.sec04OSV
  • com.alibaba:fastjson, Maven1.1.34.sec06OSV
  • com.alibaba:fastjson, Maven1.1.34.sec09OSV
  • com.alibaba:fastjson, Maven1.1.34.sec10OSV
  • com.alibaba:fastjson, Maven1.1.34_noneautotypeOSV
  • com.alibaba:fastjson, Maven1.1.35OSV
  • com.alibaba:fastjson, Maven1.1.36OSV
  • com.alibaba:fastjson, Maven1.1.37OSV
  • com.alibaba:fastjson, Maven1.1.38OSV
  • com.alibaba:fastjson, Maven1.1.39OSV
  • com.alibaba:fastjson, Maven1.1.40OSV
  • com.alibaba:fastjson, Maven1.1.41OSV
  • com.alibaba:fastjson, Maven1.1.41.sec01OSV
  • com.alibaba:fastjson, Maven1.1.41.sec04OSV
  • com.alibaba:fastjson, Maven1.1.41.sec06OSV
  • com.alibaba:fastjson, Maven1.1.41.sec10OSV
  • com.alibaba:fastjson, Maven1.1.42OSV

References 13