Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.alibaba:fastjson

4 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
2.0.66 (Oct 18, 2026): no advisory affects it
Newest unaffected release
2.0.66 (Oct 18, 2026), the latest release
Advisories
4 · 2 critical, 1 high
Dependents
116
Releases
359 since 1.1.15 (Feb 7, 2012)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • CVE-2026-16723Critical 9.0

    Remote Code Execution in fastjson 1.2.68–1.2.83

    Affected: from 1.2.68, through 1.2.83.

    Fixed in 1.2.83_noneautotype (released Jun 13, 2022, 1501 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.0.66, is not affected.

  • CVE-2025-70974Critical 10.0

    Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a…

    Affected: fixed in 1.2.48.

    Fixed in 1.2.48 (released Aug 4, 2018, 2715 days before disclosure).

    The latest release, 2.0.66, is not affected.

  • Deserialization of Untrusted Data

    Affected: from 1.2.25, fixed in 1.2.83.

    Fixed in 1.2.83 (released May 22, 2022, 19 days before disclosure).

    The latest release, 2.0.66, is not affected.

  • parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute…

    Affected: fixed in 1.2.31.

    Fixed in 1.2.31 (released Apr 3, 2017, 568 days before disclosure).

    The latest release, 2.0.66, is not affected.