fastjson 1.2.84 Release Notes

Release Date: 29 Jul 2026 Tag: 1.2.84 (72553ed)

Security fix release, backporting the fastjson2 AutoType hardening to the 1.2.x line. All users parsing untrusted JSON are strongly recommended to upgrade.

Security Fixes

1. Reject type names containing URL-special characters (:/!) in ParserConfig.checkAutoType and TypeUtils.loadClass, so a non-class-name string never reaches the class loader
2. Verify the accept name text after a whitelist hash match, so a hash collision alone cannot whitelist a type name
3. An accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types; only an accept entry naming the type in full is an explicit opt-in
4. Fixed deny classes being cached by loadClass before the blacklist check, so a repeated checkAutoType call could return a blacklisted class from the cache

Maven Dependency Configuration

:::xml
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.84</version>
</dependency>