My question/ doubt is:
Definitely keep using the HashMap.
Serializing from HashMap to JSON and back is very expensive, and should only be used when you are transferring data "across-the-wire" to the browser or the database.
When passing a HashMap, you are sharing a simple pointer that references the HashMap from your servlet to the JSP page.
There isn't any difference between these two options in terms of security, but in terms performance, it is a few orders of magnitude difference.