All packages
fastjson vulnerabilities
3 known CVE vulnerabilities in fastjson, translated and rated.
- CVE-2026-16723Critical
A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.
- CVE-2025-70974Critical
Vulnerability in Fastjson before version 1.2.48 allows an attacker to perform JNDI injection by manipulating the @type key in a JSON document. The attacker can invoke public methods of a specified Java class, leading to remote code execution. This flaw was actively exploited in the wild from 2023 to 2025.
- CVE-2024-23052Critical
A vulnerability in WukongCRM version 72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.