CVE-2022-25845: Unsafe Deserialization in com.alibaba:fastjson
Summary
CVE-2022-25845: Unsafe deserialization in com.alibaba:fastjson. Affects com.alibaba:fastjson versions >= 1.2.25, < 1.2.83. Fixed in 1.2.83. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.alibaba:fastjson is a popular JSON library for Java that provides fast and efficient JSON parsing and serialization capabilities. It is widely used in various applications and frameworks. However, versions before 1.2.83 of com.alibaba:fastjson are vulnerable to a specific type of vulnerability known as Deserialization of Untrusted Data. This vulnerability allows an attacker to bypass the default autoType shutdown restrictions, potentially leading to remote code execution on the target server.
Vulnerability Detail
The vulnerability in com.alibaba:fastjson arises due to the improper handling of deserialization of untrusted data. By exploiting this vulnerability, an attacker can craft malicious serialized objects that can be deserialized by the application, leading to arbitrary code execution. This can result in severe consequences, such as unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 2.0.66 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.83
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of com.alibaba:fastjson is not immediately feasible, a workaround is available. The library provides a 'safeMode' feature that can be enabled to mitigate the risk of unsafe deserialization. The 'safeMode' restricts the deserialization of specific types and can be configured to prevent the exploitation of this vulnerability. More information on enabling 'safeMode' can be found in the fastjson_safemode documentation.
Conclusion
The vulnerability in com.alibaba:fastjson poses a significant security risk to applications using versions before 1.2.83. It is crucial to upgrade to the latest version or enable the 'safeMode' feature to mitigate the risk of unsafe deserialization. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.alibaba:fastjson →
FAQ
com.alibaba:fastjson is a Java library that provides fast and efficient JSON parsing and serialization capabilities. It is widely used in various applications and frameworks.
The vulnerability in com.alibaba:fastjson is related to unsafe deserialization, which allows an attacker to bypass the default autoType shutdown restrictions and potentially execute arbitrary code on the target server.
Exploiting this vulnerability can lead to unauthorized access, data leakage, or complete compromise of the affected system. It poses a significant security risk to applications using vulnerable versions of com.alibaba:fastjson.
To fix this vulnerability, it is recommended to upgrade to version 1.2.83 or later of com.alibaba:fastjson. Alternatively, you can enable the 'safeMode' feature provided by the library to mitigate the risk of unsafe deserialization.
More information on enabling and configuring the 'safeMode' feature can be found in the https://github.com/alibaba/fastjson/wiki/fastjson_safemode documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.alibaba:fastjson.
