CVE-2022-25845

Deserialization of Untrusted Data

8.1 HighPublic exploitFix available

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

18.7%Up 17.7 points since Jun 11, 2022

What each source reports

CVE List Score used 8.1

Deserialization of Untrusted Data

Record: CVE-2022-25845
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-02

EUVDEUVD-2022-6120 8.1

Record: EUVD-2022-6120
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pv7h-hx5h-mgfj 8.1

Unsafe deserialization in com.alibaba:fastjson

The package com.alibaba:fastjson before 1.2.83 is vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable safeMode.

Record: GHSA-pv7h-hx5h-mgfj
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

NVD 8.1

Record: CVE-2022-25845
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

OSV 8.1

Deserialization of Untrusted Data

Record: CVE-2022-25845
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-02

OSVGHSA-pv7h-hx5h-mgfj 8.1

Unsafe deserialization in com.alibaba:fastjson

Record: GHSA-pv7h-hx5h-mgfj
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.alibaba:fastjson` Maven	1.2.25 up to 1.2.83	1.2.83
`com.alibaba:fastjson` Maven	1.2.25 up to 1.2.83, plus listed versions 1.2.25.sec101.2.261.2.271.2.27.sec061.2.27.sec09 Show 45 moreShow less 1.2.27.sec101.2.281.2.28.odps1.2.291.2.29.sec041.2.29.sec061.2.29.sec091.2.29.sec101.2.301.2.311.2.31.sec101.2.31_noneautotype1.2.321.2.331.2.341.2.351.2.361.2.371.2.381.2.391.2.401.2.411.2.421.2.431.2.441.2.451.2.461.2.471.2.481.2.48.sec061.2.48.sec091.2.48.sec09_noneautotype1.2.48.sec101.2.48_noneautotype1.2.491.2.501.2.50.sec101.2.50_noneautotype1.2.511.2.51.sec061.2.51.sec101.2.521.2.52.sec061.2.52.sec09_noneautotype1.2.52.sec10	1.2.83

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	cuijiung/fastjson-CVE-2022-25845	2025-07-11
PoC in GitHub	luelueking/CVE-2022-25845-In-Spring	2024-11-07
PoC in GitHub	nerowander/CVE-2022-25845-exploit	2023-03-01
PoC in GitHub	ph0ebus/CVE-2022-25845-In-Spring	2024-11-26
PoC in GitHub	scabench/fastjson-tp1fn1	2024-01-28

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25845 is a high vulnerability (CVSS 8.1) in Alibaba Fastjson, published June 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.7%, the 97th percentile. Fixed in com.alibaba:fastjson 1.2.83.

References

Show 5 moreShow less

This page doesn't list everything

Left out here: 53 versions. The JSON record has them.