Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

FASTJSON Includes Functionality from Untrusted Control Sphere

Fix availableCritical · CVSS 10EPSS 0.76%

Published Jan 9, 2026 · updated Oct 5, 2026

What to do

  1. Upgrade to a fixed version: com.alibaba:fastjson 1.2.48.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavencom.alibaba:fastjson

Vulnerable versions
< 1.2.48
Fixed in
1.2.48

Check your project: mvn dependency:tree -Dincludes=com.alibaba:fastjson

Sources

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

← All critical vulnerabilities