Unpatched Fastjson 1.x Remote Code Execution Flaw Under Active Attack
Attackers are exploiting a critical RCE vulnerability in Fastjson 1.x, with no official patch available. Site owners using Java-based applications are urged to mitigate immediately.
A severe remote code execution (RCE) vulnerability in the widely used Fastjson library version 1.x is being actively targeted in the wild, according to security researchers. The flaw allows unauthenticated attackers to execute arbitrary code on servers that parse untrusted JSON data, posing a direct threat to any web application or service relying on the library. Fastjson, a high-performance Java library for converting Java objects to JSON and vice versa, is commonly embedded in countless enterprise and cloud applications.
With no official patch released for the 1.x branch, organizations using this outdated version face an immediate risk. The vulnerability stems from Fastjson's autoType feature, which is enabled by default and can be tricked into deserializing malicious classes, leading to code execution. Security advisories recommend disabling autoType or enabling safeMode as a workaround, though these changes may break existing functionality. For long-term protection, upgrading to Fastjson 2.x or switching to alternative libraries like Jackson or Gson is advised.
Active exploitation has been observed, with attackers using specially crafted JSON payloads to deploy webshells, ransomware, or cryptocurrency miners. Because Fastjson is often deeply integrated into third-party frameworks, many administrators may not be aware they are exposed. Security teams should inventory all Java applications and check for the presence of Fastjson 1.x, prioritizing internet-facing services. Web application firewalls can temporarily block malicious payloads, but they are not a substitute for removing the vulnerable library.
This incident highlights the danger of relying on unmaintained software components. Website owners and IT departments should adopt a proactive approach to dependency management, including regular vulnerability scanning and prompt patching. For businesses concerned about unpatched library vulnerabilities in their infrastructure, AEU-I offers security-first IT and consulting to help identify and mitigate such risks.