CVE-2025-70974criticalobserved exploitationCWE-829

CVE-2025-70974: critical vulnerability in Alibaba Fastjson

Published · Updated

Follow this CVE+ Monitor Fastjson+ Monitor com.alibaba:fastjson

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 10epss 0.7%
from disclosure to weapon
Published on NVDJan 9
VulnCheckJun 23
In short

Fastjson library before version 1.2.48 allows attackers to execute arbitrary code by embedding malicious Java class names in JSON documents. When processing JSON with @type fields, the library instantiates these classes and calls their methods, which can be exploited to inject and execute remote code.

Technical detail

Fastjson's autoType feature deserializes arbitrary Java classes specified via @type keys in JSON input without sufficient validation, enabling JNDI injection attacks. An attacker can craft a JSON payload that triggers instantiation of gadget classes whose constructors or methods execute arbitrary code; this is a deserialization RCE vulnerability that bypasses incomplete fixes from CVE-2017-18349.

Summary generated and translated by AI from the official description.
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Alibaba · Fastjson
Related CVEs — Alibaba Fastjson

In the same product, most dangerous first.

CVE-2026-16723CRITICALRemote Code Execution in fastjson 1.2.68–1.2.83EPSS 0.7%