Let me start with some bad news. If you are using Fastjson, Alibaba's popular JSON library for Java, there is a critical vulnerability that attackers are already targeting. And here is the kicker: as of July 25, there is no patched version of Fastjson 1.x available.
Security firms ThreatBook and Imperva have confirmed that attackers are actively exploiting this Fastjson vulnerability in the wild. It is tracked as CVE-2026-16723, and it carries a CVSS score of 9.0. That is about as bad as it gets.
The really troubling part? A malicious JSON request can execute code on your server without any authentication. No credentials needed. No special privileges. Just a well-crafted JSON payload sent to an affected application.
Let me walk you through what is happening, why it matters, and what you can do about it.
What Is the Fastjson Vulnerability CVE-2026-16723?
The Fastjson vulnerability CVE-2026-16723 is a remote code execution (RCE) flaw related to how Fastjson processes type resolution. Specifically, Fastjson provides a feature allowing it to deserialize JSONs into specific java classes. Attackers figured out how to abuse this feature to load and execute malicious code.
What makes this Fastjson vulnerability particularly nasty is that it does not require AutoType to be enabled. If you have been following Fastjson security issues over the years, you know that AutoType has been a recurring headache. The maintainers have released multiple patches to address AutoType bypasses.
But CVE-2026-16723 bypasses that whole line of defense. AutoType can remain disabled. No classpath gadget is required. The attack works through a completely different path.
How Does This Fastjson Vulnerability Work?
The researcher who discovered this Fastjson vulnerability, Kirill Firsov of FearsOff Cybersecurity, traced the issue to Fastjson's type-resolution mechanism. An attacker can control the @type value in a JSON payload. Under normal circumstances, Fastjson uses this to determine which class to deserialize into.
But in this specific Fastjson vulnerability, the @type value can trigger a class-resource lookup. In a Spring Boot application packaged as a fat-JAR which is a common deployment format, a crafted nested JAR path can fetch attacker-controlled bytecode.
Here is where it gets interesting. An @JSONType annotation in that resource can be treated as a trust signal. Fastjson accepts it, passes its type checks, and loads the malicious class. Code execution achieved.
Firsov also documented a newer-JDK path that downloads a remote JAR and references it through /proc/self/fd. Attackers have options, and that is never a good sign.
Which Versions Are Affected by This Fastjson Vulnerability?
The Fastjson vulnerability CVE-2026-16723 affects versions 1.2.68 through 1.2.83. This range is significant because 1.2.83 was the recommended upgrade for a previous AutoType bypass disclosed in 2022. That final 1.x release is now sitting squarely inside the affected range for this new vulnerability.
The confirmed chain requires a few conditions:
- Fastjson 1.2.68 through 1.2.83
- A Spring Boot executable fat-JAR
- A network-reachable path that sends attacker-controlled JSON to an affected parser
- SafeMode left at its disabled default
The maintainers verified the Fastjson vulnerability on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21. That covers a wide range of modern Java environments.
What Is Not Affected?
Not all deployments are vulnerable to this Fastjson vulnerability. Alibaba lists plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments as unaffected. If you are running a traditional web application deployment, you may be safe.
The exploit depends specifically on the Spring Boot executable fat-JAR loader. If your application is deployed differently, this Fastjson vulnerability may not be exploitable in your environment.
What Attack Vectors Exist?
Reachable entry points for the above mentioned Fastjson Vulnerability would be through calls to JSON.parse, JSON.parseObject(String) and JSON.parseObject(String,Class). These are commonly used functions within Java Applications.
Here is an important nuance: binding input to a fixed class is not sufficient protection when an object contains an Object or Map field where the payload can be nested. Even if you think you are safely parsing JSON into a specific class, an attacker may be able to slip a malicious @type value into a nested field.
Is This Fastjson Vulnerability Being Exploited in the Wild?
Yes. And this is the part that should concern you most. The Hacker News reported that ThreatBook noted on July 22 that its platform had captured in-the-wild exploitation after adding detection support two days earlier.
Imperva reported activity against multiple sectors: financial services, healthcare, computing, retail, and others. The attacks primarily targeted organizations in the United States, with smaller volumes in Singapore and Canada. According to The Hacker News, Imperva said browser impersonators generated most requests, while Ruby and Go tools represented about 30 percent collectively.
Neither vendor published attack counts, raw requests, or confirmed evidence of successful code execution. But the activity is real. Attackers are scanning for and targeting this Fastjson vulnerability.
A July 23 CISA-ADP assessment marked exploitation as none. And as of July 25, CVE-2026-16723 was absent from the Known Exploited Vulnerabilities catalog. This mismatch is puzzling, but here is the reality: ThreatBook and Imperva have observed attack activity. Whether the exploitation has been successful in real-world environments is less certain, but attackers are clearly interested.
No Patch for Fastjson 1.x Yet
Here is the uncomfortable truth about this Fastjson vulnerability: as of July 25, Alibaba has not released a fixed Fastjson 1.x version. The Hacker News confirmed that they found no patched Fastjson 1.x artifact in the project's GitHub tags or Maven Central repository. Version 1.2.83 remains the latest standard 1.x release.
Alibaba published its advisory on July 21, following responsible disclosure by Firsov. The maintainers described the Fastjson vulnerability as requiring no AutoType enablement and no classpath gadget. They acknowledged the severity, but a patched artifact is not yet available.
For organizations that rely on Fastjson 1.x, this is a problem. The attack is public. The vulnerability is real. And there is no official patch.
What Can You Do Right Now?
The absence of a patch does not mean you are helpless. Alibaba has provided clear guidance for mitigating this Fastjson vulnerability.
The main mitigation would be enabling SafeMode which will limit fastjson’s behaviors. To do this, simply set the following JVM parameter:
-Dfastjson.parser.safeMode=trueYou could also consider using this restricted version of fastjson instead: com.alibaba:fastjson:1.2.83_noneautotype (certain features are disable with this build to decrease its attack surface).
For the long term, Alibaba recommends migrating to Fastjson2. The newer version is not affected by this Fastjson vulnerability because it does not use the same resource-probing or annotation-based trust path.
What Should You Look For?
If you are worried about this Fastjson vulnerability, start by inventorying your direct and transitive Fastjson dependencies. Many Java projects pull in Fastjson indirectly through other libraries.
The Hacker News advises inspecting affected systems for suspicious @type values in JSON payloads. Look for nested JAR urls, unexpected outbound connections, child processes, file changes, web shells, etc. This shows an indication of exploitation. These are signs that exploitation may have occurred.
The Irony of This Fastjson Vulnerability
There is a bitter irony here. Fastjson 1.2.83 was Alibaba's recommended upgrade for a separate AutoType bypass disclosed in 2022. That patch was supposed to be the final word on Fastjson 1.x security. Organizations that diligently upgraded to the latest version are now vulnerable to a new attack.
This Fastjson vulnerability demonstrates that security is not a one-time fix. It is an ongoing process. The threat landscape evolves, and so do the attacks.
What Happens Next?
The Hacker News has reached out to Alibaba for clarification on the affected versions and Fastjson 1.x patch plans, and to Imperva for details about the reported exploitation activity. They have stated they will update the story with any response.
For now, the message is clear. If you are running a Spring Boot application with Fastjson 1.2.68 through 1.2.83, you need to act. Enable SafeMode. Consider migrating to Fastjson2. And keep an eye on your systems for signs of compromise.
This Fastjson vulnerability is not going away just because there is no patch. Attackers are already probing for it. Do not give them an opportunity to find it in your environment.
FAQ Section
What is the Fastjson vulnerability CVE-2026-16723?
It is a remote code execution flaw in Alibaba's Fastjson JSON library for Java. Attackers can send a malicious JSON payload to execute code on vulnerable servers without authentication. The vulnerability affects Fastjson versions 1.2.68 through 1.2.83 in Spring Boot fat-JAR deployments.
Which applications are vulnerable to this Fastjson vulnerability?
Spring Boot applications packaged as executable fat-JARs running Fastjson 1.2.68 through 1.2.83 are vulnerable. Plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments are not affected by this specific attack chain.
Has this Fastjson vulnerability been patched?
No. As of July 25, 2026, Alibaba has not released a patched Fastjson 1.x version. The Hacker News confirmed no patched artifact exists in GitHub tags or Maven Central. The maintainers recommend enabling SafeMode as a temporary mitigation and migrating to Fastjson2 as the long-term solution.
How do I protect myself from that Fastjson vuln?
The easiest way would be to enable the SafeMode of fastjson with an additional parameter -Dfastjson.parser.safeMode=true on the JVM’s startup parameters.
An alternative option could be using the restricted build com.alibaba:fastjson:1.2.83_noneautotype. Migrating to Fastjson2 is recommended for permanent protection.
Is this Fastjson vulnerability already being exploited in the wild?
Yes, according to ThreatBook and Imperva, which report that there have been active attempts to exploit this hole against victims from across several industries including those in financial services, healthcare, retail and others. Attacks are primarily targeting organizations in the United States, Singapore, and Canada, according to reporting by The Hacker News.
