Fastjson 1.x Exposes Critical CVSS 9.8 RCE Vulnerability and What to Do

Fastjson 1.x Remote‑Code‑Execution Vulnerability

Fastjson 1.x versions 1.2.66–1.2.83 contain a remote‑code‑execution (RCE) vulnerability that can be triggered without a gadget chain. The flaw has a CVSS score of 9.8 and is exploitable in a Spring Boot FatJar running on JDK 8.

Affected versions : 1.2.66–1.2.83 (including the officially declared “final safe version” 1.2.83).

Exploitation conditions : Default configuration is sufficient; disabling autoType or binding a concrete type does not prevent exploitation.

Impact : Arbitrary code execution in typical Spring Boot + JDK 8 deployments.

POC : Exploit code was published on GitHub the day after disclosure.

The vulnerability was disclosed on 2026‑07‑19 by security researcher Kirill Firsov on Twitter. Fastjson 1.x stopped receiving maintenance in 2024; the last official 1.x release (1.2.83) was published in 2022, and the project now provides security‑only updates.

Mitigation Options

Migrate to Fastjson 2.x – update the Maven/Gradle dependency, replace import statements that reference com.alibaba.fastjson with the new package, and run regression tests. This eliminates the vulnerability because Fastjson 2.x rewrites the architecture.

Enable SafeMode – add the JVM argument -Dfastjson.parser.safeMode=true. This disables automatic @type loading and mitigates the exploit.

Use the noneautotype build – replace the Maven coordinates with the fastjson:noneautotype artifact, which removes AutoType support at compile time.

None of these mitigations require forking the library or submitting a pull request.

Practical Steps for Migration

Modify pom.xml (or build.gradle) to depend on com.alibaba.fastjson2:fastjson2 (latest stable version).

Replace import statements, e.g., change import com.alibaba.fastjson.JSON; to import com.alibaba.fastjson2.JSON;.

Rebuild the project and execute existing test suites to verify functional parity.

If immediate migration is not feasible, add the JVM flag -Dfastjson.parser.safeMode=true or switch to the noneautotype artifact as a temporary mitigation.

Contextual Background

Fastjson 1.x was introduced in 2012 and discontinued in 2024. The vulnerability is part of a long history of deserialization issues in Fastjson, ranging from versions 1.2.24 to 1.2.47, where autoType handling has been repeatedly patched.