The critical remote code execution vulnerability CVE-2026-16723 in the Alibaba Fastjson 1.x library (versions 1.2.68–1.2.83) allows an attacker to execute arbitrary code via a malicious JSON request without authentication—provided that the application is deployed as a Spring Boot fat-JAR and SafeMode is left disabled by default. Alibaba has assigned the vulnerability a CVSS 9.0 score. According to ThreatBook and Imperva, exploitation attempts are already being observed in real-world traffic, while as of July 25 no patch for Fastjson 1.x has been released. Organizations using affected versions must immediately enable SafeMode or migrate to Fastjson2.
Technical details of the vulnerability
On 21 July, Alibaba published a security advisory following responsible disclosure by researcher Kirill Firsov from FearsOff Cybersecurity. The vendor confirmed reproduction of the exploit chain on Spring Boot 2.x, 3.x and 4.x with JDK 8, 11, 17 and 21.
Key characteristics of the vulnerability confirmed by Alibaba:
- Affected versions: Fastjson 1.2.68 — 1.2.83
- Exploitation condition: the application is deployed as a Spring Boot executable fat-JAR
- Attack vector: network access to an endpoint that passes attacker-controlled JSON into the Fastjson parser
- SafeMode: must be disabled (the default state)
- AutoType: not required — exploitation works with AutoType disabled
- Classpath gadget: not required
The last point deserves special attention. Previous Fastjson vulnerabilities, including the 2022 AutoType bypass, required either AutoType to be enabled or a suitable gadget to be present on the classpath. CVE-2026-16723 bypasses both restrictions, which significantly enlarges the attack surface.
Exploitation mechanism
According to the researcher’s technical analysis, the problem lies in Fastjson’s type resolution mechanism. An attacker-controlled @type value is converted into a class resource lookup. In the context of a Spring Boot fat-JAR, a specially crafted path to an embedded JAR file makes it possible to load the attacker’s bytecode. The @JSONType annotation in this resource is treated by the parser as a trust signal, after which the class passes Fastjson’s type checks and is loaded.
Vulnerable entry points include JSON.parse, JSON.parseObject(String) and JSON.parseObject(String, Class). Alibaba emphasizes that binding input data to a fixed class is not sufficient protection if the object contains a field of type Object or Map, into which a malicious payload can be embedded.
Alibaba notes that the following are not affected: regular JAR files (not fat-JAR), standard uber-JARs, and deployments as WAR on Tomcat or Jetty.
Observed exploitation activity
The situation around confirmed exploitation remains ambiguous. On 22 July, ThreatBook reported observing exploitation attempts in live traffic. In lab conditions, the company reproduced full code execution on a Spring Boot fat-JAR with JDK 8, while a test with embedded Tomcat led only to remote JAR loading or SSRF.
Imperva observed activity targeting organizations in the financial services, healthcare, technology and retail sectors—primarily in the US, with smaller volumes in Singapore and Canada. According to the company, most requests were generated by browser automation tools, while Ruby and Go tools accounted for about 30% of the traffic.
However, none of the vendors have published the number of attacks, raw requests, evidence of successful code execution, victim names or confirmed compromises. The reports document observed exploitation activity but do not prove successful intrusions into real systems.
The picture is further blurred by CISA’s stance: the CISA-ADP assessment from 23 July marked the exploitation status as none, and the vulnerability is absent from the KEV catalog. The reasons for this discrepancy with vendor data have not been explained.
Impact assessment
Fastjson is one of the most widely used JSON libraries in the Java ecosystem, particularly popular among Chinese-speaking developers. The vulnerability affects any application that meets four conditions: Fastjson version 1.2.68–1.2.83, packaging as a Spring Boot fat-JAR, presence of a network endpoint that parses JSON, and SafeMode disabled. Given that SafeMode is disabled by default and Spring Boot fat-JAR is a standard deployment format, a significant share of applications may be vulnerable.
An especially serious concern is that version 1.2.83 was Alibaba’s recommended update to address the previous AutoType bypass in 2022. Organizations that diligently upgraded to the latest 1.x version now fall squarely within the vulnerable range.
Mitigation recommendations
As of July 25, a patch for Fastjson 1.x has not been released—version 1.2.83 remains the latest standard release in the 1.x branch. Alibaba suggests the following measures:
- Immediately: enable SafeMode — add the JVM parameter
-Dfastjson.parser.safeMode=truewhen starting the application - Alternative: use the restricted build — replace the dependency with
com.alibaba:fastjson:1.2.83_noneautotype - Long term: migrate to Fastjson2 — this version is not vulnerable, as it does not use the same resource lookup and annotation-based trust mechanism
Additional actions for security teams:
- Inventory all direct and transitive dependencies on Fastjson across projects
- Check affected systems for suspicious
@typevalues in JSON requests - Look for indicators of compromise: embedded JAR file URLs, unusual outbound connections, child Java processes, file system changes and web shells
- Assess the deployment format—applications running as regular JARs, uber-JARs, or WARs on Tomcat/Jetty are not affected by this vulnerability
Given the CVSS 9.0 score, the absence of a patch, and the observed exploitation activity (even if without confirmed compromises), enabling SafeMode or switching to the restricted 1.2.83_noneautotype build should be treated as a priority. Organizations that rely on Fastjson 1.x in production systems should begin planning migration to Fastjson2—Alibaba clearly positions the 1.x branch as end-of-life, and the current situation confirms that one should not count on a fixed 1.x release.
