Type resolution is the logic a parser or deserializer uses to decide which class or object type should be created from incoming data. In Java applications, this often happens when JSON or another serialized format is converted back into objects the program can use. If that decision is based on attacker-controlled input, the parser may create an unexpected class, which can change application behavior in dangerous ways.
Security teams care about type resolution because it sits at the boundary between data and code. Weak or overly flexible type resolution can enable deserialization bugs, gadget abuse, and remote code execution, especially in libraries such as Fastjson. Defenses include disabling automatic type inference, using strict allowlists, validating input before parsing, patching vulnerable libraries, and avoiding dynamic object creation unless it is truly required.