Fastjson 1.x RCE Actively Exploited With No Patch Available

Security researchers at ThreatBook and Imperva have confirmed active in-the-wild exploitation of CVE-2026-16723, a critical remote code execution vulnerability in Alibaba's Fastjson 1.x JSON parsing library. The flaw affects Spring Boot fat-JAR deployments and carries a CVSS score of 9.0. As of July 25, 2026, no patched version of Fastjson 1.x exists.

What Is the Vulnerability?

CVE-2026-16723 was disclosed by researcher Kirill Firsov of FearsOff Cybersecurity. The vulnerability exploits Fastjson's @type type-resolution mechanism — a feature that allows JSON consumers to specify the Java class to deserialize into. In Spring Boot fat-JAR deployments (executable JARs with embedded dependencies), attackers can craft a malicious JSON payload with an attacker-controlled @type value that triggers class-resource lookups from hostile locations.

Inside a fat-JAR, nested path traversal allows retrieval of hostile bytecode. A @JSONType annotation in the fetched resource acts as a trust signal that bypasses Fastjson's type-checking logic, ultimately loading and executing arbitrary code with the privileges of the Java process — all without authentication.

Any endpoint calling JSON.parse(), JSON.parseObject(String), or JSON.parseObject(String, Class) is a potential entry point. Objects containing Object or Map fields allow nested payloads that defeat partial protections.

Affected Versions

Version 1.2.83 is the latest release of the Fastjson 1.x branch and remains vulnerable with no fix available.

Active Exploitation

ThreatBook added detection for CVE-2026-16723 on July 22 and observed in-the-wild exploitation almost immediately, primarily via browser-impersonating user agents. Imperva has since reported attacks targeting organizations across:

• Financial services
• Healthcare
• Computing and technology
• Retail

The United States is the primary target, with smaller volumes observed in Singapore and Canada. Approximately 30% of observed malicious request volume originates from Ruby and Go tooling, suggesting structured attack infrastructure rather than opportunistic scanning.

Neither vendor has confirmed successful code execution on production systems in its public reporting, but the exploitation activity underscores that threat actors are actively weaponizing the vulnerability.

Why This Has Wide Blast Radius

Fastjson is one of the most widely used JSON libraries in the Java ecosystem, particularly in China-originated enterprise applications. The Spring Boot fat-JAR deployment model — an extremely common production pattern — is specifically required for exploitation, meaning a large proportion of Fastjson 1.x deployments are exposed.

The fact that SafeMode is disabled by default in Fastjson 1.x further widens the attack surface. SafeMode blocks the @type mechanism entirely, but most applications haven't enabled it.

Mitigations

Since no patch exists for Fastjson 1.x, operators must use one of the following mitigations immediately:

Option 1: Enable SafeMode (Immediate, Low Risk)

Add the JVM flag at startup:

-Dfastjson.parser.safeMode=true

Or programmatically:

ParserConfig.getGlobalInstance().setSafeMode(true);

SafeMode disables @type processing entirely. This may break applications relying on polymorphic deserialization.

Option 2: Switch to the Non-AutoType Build

Replace the standard dependency with the restricted variant:

<dependency>
  <groupId>com.alibaba</groupId>
  <artifactId>fastjson</artifactId>
  <version>1.2.83_noneautotype</version>
</dependency>

Option 3: Migrate to Fastjson 2.x (Recommended Long-Term)

Fastjson 2.x is not affected by this vulnerability. Organizations running Fastjson 1.x should plan a migration to Fastjson 2.x as the definitive resolution. The two major versions are not drop-in compatible, so testing is required.

Immediate Triage Steps

1. Inventory all Spring Boot applications using Fastjson 1.2.68–1.2.83
2. Check whether SafeMode is enabled — assume it is not unless explicitly set
3. Review endpoints accepting JSON input and calling vulnerable parse methods
4. Enable SafeMode or switch to noneautotype build as an emergency measure
5. Monitor for exploitation attempts — look for @type keys in request bodies with unexpected class names

Key Takeaways

• CVE-2026-16723 (CVSS 9.0) — Pre-auth RCE in Fastjson 1.x via @type injection in Spring Boot fat-JARs
• No patch available for Fastjson 1.x — mitigation is required now
• Active exploitation confirmed by ThreatBook and Imperva within days of disclosure
• SafeMode is the fastest fix — enable via JVM flag or programmatically
• Long-term path is Fastjson 2.x — unaffected and actively maintained

References

• The Hacker News — Fastjson 1.x RCE Vulnerability Targeted in Attacks
• NVD — CVE-2026-16723
• Fastjson GitHub — SafeMode documentation