Fastjson 1.x Exposes Critical CVSS 9.8 RCE Vulnerability and What to Do
Fastjson 1.x (versions 1.2.66‑1.2.83) contains a CVSS 9.8 remote‑code‑execution flaw that works with default settings, was disclosed in July 2026, and sparked heated community debate, while the library had already been unmaintained since 2024 and official guidance now recommends migration to Fastjson 2.x or enabling SafeMode.
