CVE-2025-70974: Critical severity maven/com.alibaba/fastjson vulnerability
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
Other sources
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.alibaba:fastjsonto a version that resolves this vulnerability.Fixed in 1.2.48 - Upgrade
Upgrade
fastjsonto a version that resolves this vulnerability.Fixed in 1.2.48 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2017-18349 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-25845
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70974?
CVE-2025-70974 is considered a critical vulnerability due to the potential for JNDI injection and the execution of arbitrary code.
How do I fix CVE-2025-70974?
To fix CVE-2025-70974, upgrade Fastjson to version 1.2.48 or later.
What versions of Fastjson are affected by CVE-2025-70974?
CVE-2025-70974 affects all versions of Fastjson prior to 1.2.48.
What types of applications are at risk from CVE-2025-70974?
Applications that utilize Fastjson for JSON processing and allow user-controlled JSON input are at risk from CVE-2025-70974.
What are the potential impacts of CVE-2025-70974?
The potential impacts of CVE-2025-70974 include unauthorized access, data manipulation, and execution of arbitrary code through remote code execution.