Login Request a demo
FA
Product
Fastjson
by Alibaba · last CVE Jul 23, 2026
4
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities4In the news1Timeline
Severity mix
Critical 4High 0Medium 0Low 0
Severity
All severities4Critical4High0Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Fastjson to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-70974
10.0
1%
Jan 9
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain…
Affected: before 1.2.48
CVE-2022-25845
9.8
19%
Jun 10
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under…
Affected: before 1.2.83
CVE-2017-18349
9.8
39%
Oct 23
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request,…
Affected: before 1.2.25
CVE-2026-16723
9.0
1%
Jul 23
Remote Code Execution in fastjson 1.2.68–1.2.83
Affected: 1.2.68 through 1.2.83
Showing 4