Fastjson 1.x RCE Vulnerability Exploited in Attacks, No Official Fix Available
A critical remote code execution flaw in Fastjson 1.x is actively exploited, and no patch will be issued as the library is end-of-life. Site owners using Java applications must act now.
Security researchers have identified active exploitation of a remote code execution vulnerability in Fastjson version 1.x, a widely used Java library for parsing JSON. The flaw allows unauthenticated attackers to execute arbitrary commands on vulnerable servers by sending specially crafted JSON payloads. Since Fastjson 1.x has reached end-of-life, the maintainers have announced that no official patch will be released for this issue.
The vulnerability stems from the library's autoType feature, which—when enabled—deserializes unsafe classes from incoming JSON data. Attackers can leverage this to instantiate dangerous classes that lead to code execution. Although this class of issues has plagued Fastjson for years, many organizations still run outdated versions or have not properly configured the library to disable autoType globally. The current campaign reportedly scans for exposed endpoints that accept JSON and attempts to exploit the flaw to install malware or establish persistent backdoors.
Website owners and IT teams using Java-based applications, APIs, or third-party services that depend on Fastjson 1.x are at risk. Even if the vulnerable library is not directly exposed, it may be embedded in backend systems or dependencies. Immediate mitigation includes upgrading to Fastjson 2.x, which is actively maintained and fundamentally more secure, or replacing the library with a safer alternative like Jackson or Gson. If an immediate migration is not possible, organizations should ensure autoType is explicitly turned off and implement strict network filtering to limit exposure of affected services.
For hosting providers and site operators, the incident underscores the importance of regular software inventory and vulnerability management. Unsupported libraries lingering in the stack create blind spots that attackers can exploit long after official support ends. AEU-I, with its security-first IT and consulting services, assists businesses in auditing their infrastructure, identifying such risky components, and planning remediation before they become a target. Proactive defense remains the best line of defense in an ever-evolving threat landscape.