Fastjson RCE Flaw Risks Java Applications

Unpatched Risks in Java Environments

Security researchers have identified a high-severity remote code execution flaw within Fastjson, a widely used JSON library for Java. Tracked as CVE-2026-16723, the vulnerability enables an attacker to execute arbitrary code with the full privileges of the underlying Java process by sending a malicious JSON request to a vulnerable application.

The issue resides in the type-resolution logic of Fastjson versions 1.2.68 through 1.2.83. Security analysts determined that when an application uses a Spring Boot executable fat-JAR, an attacker can leverage a crafted nested JAR path to force the system to fetch and execute external bytecode. Because the library incorrectly interprets specific annotations as trust signals, the malicious class bypasses internal type checks.

Vulnerability Scope and Technical Details

The flaw manifests primarily when the SafeMode feature is left at its default disabled state. Unlike previous iterations of similar vulnerabilities, this exploit chain does not require the user to have AutoType enabled, nor does it rely on a classpath gadget. The vulnerability affects environments running Spring Boot 2.x, 3.x, and 4.x alongside JDK versions 8, 11, 17, and 21.

The maintainers described the vulnerability as requiring "no AutoType enablement" and "no classpath gadget."

The maintainers of the project provided this assessment regarding the vulnerability's configuration requirements.

• Alibaba assigned the vulnerability a CVSS score of 9.0.
• The affected Fastjson version range is 1.2.68 through 1.2.83.
• Imperva reported that non-browser tools, specifically Ruby and Go scripts, accounted for approximately 30% of observed request traffic.
• The CISA-ADP assessment currently marks active exploitation as none.

Active Observations and Defensive Measures

As of July 25, 2026, Alibaba has not provided a direct patch for the 1.x line of the library. Organizations are currently advised to transition to Fastjson2, which is not susceptible to the same resource-probing or annotation-based trust mechanisms. For those unable to perform an immediate migration, the project maintainers suggest enabling SafeMode using the flag -Dfastjson.parser.safeMode=true or migrating to the version 1.2.83_noneautotype build.

Firms including ThreatBook and Imperva have reported detecting exploit attempts targeting various sectors, including healthcare and financial services. While these vendors have observed malicious traffic patterns, there is currently no confirmed evidence of successful system compromise or full-scale data breaches resulting from these specific attacks.

Implications for Enterprise Security

The persistence of this flaw in a library version previously positioned as a secure release—1.2.83—highlights the complexity of managing dependencies in large-scale Java ecosystems. For security teams, the primary concern lies in the vulnerability's reliance on the structure of Spring Boot fat-JARs, which complicates traditional perimeter defenses. If an organization's internal inventory does not accurately map transitive dependencies, they may remain unaware of their exposure to this remote code execution path. Until a formal patch is issued, reliance on configuration-based mitigations remains the only viable path to reduce the attack surface for internal and external facing services.