Executive Summary
CVE-2026-16723 is a critical remote code execution (RCE) vulnerability in the widely deployed fastjson Java library, affecting versions 1.2.68 through 1.2.83. Unlike earlier fastjson exploits, this flaw requires no AutoType enablement and no classpath gadget — meaning the standard blocklist mitigations that defenders relied upon for years offer no protection. Any application running these versions under the default configuration is exploitable. Researcher Kirill Firsov (FearsOff Cybersecurity) disclosed the vulnerability on July 19, 2026, and working public proof-of-concept code is already circulating.
CVSS score: 9.0 (Critical)
Vulnerability Details
What Changed
Previous fastjson RCE chains depended on two preconditions that defenders could control: AutoType had to be explicitly enabled, and a suitable deserialization gadget had to be on the classpath. CVE-2026-16723 eliminates both requirements entirely.
The flaw bypasses fastjson's AutoType black/whitelist protection at a fundamental level. Specifying a target class (e.g., JSON.parseObject(body, SomeDto.class)) does not mitigate the vulnerability — attackers can nest malicious payloads inside Object- or Map-typed fields within the target class, and fastjson will deserialize them without enforcement.
Exploitation Prerequisites
The only deployment prerequisite is that the application runs as a Spring Boot executable fat-jar (java -jar), which is the dominant Spring Boot packaging model. The vulnerability has been verified against:
- Spring Boot 2.x, 3.x, and 4.x
- JDK 8, 11, 17, and 21
No authentication, special configuration, or gadget is required. Remote, unauthenticated code execution is achievable in default deployments.
Scope
- Affected: fastjson 1.2.68 through 1.2.83 (the 1.x branch is end-of-life)
- Not affected: fastjson2 (the modern rewrite) — completely separate codebase
- Estimated exposure: Qi'anxin estimates millions of exposed instances globally
Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the Java process. In typical Spring Boot deployments this means full server compromise, data exfiltration, and lateral movement. Because fastjson is embedded in countless enterprise Java applications across banking, e-commerce, and government sectors — particularly in the Asia-Pacific region — the blast radius is substantial.
Mitigation
Immediate Actions (in priority order)
-
Enable Safe Mode (temporary mitigation until migration is complete):
- JVM flag:
-Dfastjson.parser.safeMode=true - Programmatic:
ParserConfig.getGlobalInstance().setSafeMode(true) - Config file: add
fastjson.parser.safeMode=truetofastjson.properties
- JVM flag:
-
Migrate to fastjson2 — the only permanent fix. fastjson 1.x is end-of-life and will receive no security patches. fastjson2 is not affected by this vulnerability.
-
Do not rely on blocklists, gadget removal, or target-class specification — these are ineffective against CVE-2026-16723.
Detection
Monitor for unusual outbound network connections or process spawning from JVM processes handling JSON input. Review application logs for unexpected deserialization activity. SIEM rules targeting the Safe Mode JVM flag absence combined with fastjson 1.2.x version detection are advised.