com.alibaba:fastjson vulnerabilities

CVEs whose affected-version data names the com.alibaba:fastjson package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-70974Critical· 10.0

9mo ago

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of …

▾ Midnightalibaba · com.alibaba:fastjsonEPSS 0.75%via NVD