Critical RCE Vulnerability in Fastjson 1.x Actively Exploited in Attacks
Unpatched flaw in Alibaba's Java JSON library allows remote code execution in Spring Boot applications.
1Vulnerability details and scope
Tracked as CVE-2026-16723, this vulnerability affects Fastjson versions 1.2.68 through 1.2.83. In Spring Boot fat-JAR deployments, it enables unauthenticated code execution with Java process privileges. Attackers can manipulate @type values to trigger class resource lookups. The vulnerability remains exploitable even with AutoType disabled and SafeMode at default off setting. Alibaba assigned a CVSS score of 9.0 to this flaw.
2Affected systems and components
Only Spring Boot executable fat-JAR distributions are vulnerable. Standard JARs, uber-JARs, and Tomcat/Jetty WAR deployments remain unaffected. Attack vectors include accessible endpoints like JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). The exploit chain has been verified on Spring Boot 2.x, 3.x, and 4.x running JDK 8, 11, 17, and 21. Fastjson2's different architecture makes it immune to this vulnerability.
3Mitigation measures and long-term solutions
Alibaba recommends migrating to Fastjson2 as the permanent fix. Immediate workarounds include enabling SafeMode via -Dfastjson.parser.safeMode=true or using the 1.2.83_noneautotype build. Organizations should inventory all Fastjson dependencies (direct and transitive) and scan systems for suspicious @type values, nested JAR URLs, unexpected outbound connections, and web shells.
4Observed attack activity
ThreatBook reported in-the-wild exploitation on July 22. Imperva observed attacks primarily targeting US-based financial services, healthcare, retail, and computing organizations, with smaller volumes in Singapore and Canada. Approximately 70% of attacks came from browser-impersonating tools, while Ruby and Go scripts accounted for 30%. No confirmed breaches or named victims have been disclosed yet.
5Patch status and institutional response
As of July 25, no patched Fastjson 1.x version has been released. Version 1.2.83 remains the latest stable release in GitHub tags and Maven Central. Interestingly, CISA's Known Exploited Vulnerabilities catalog doesn't include this flaw despite vendor confirmations. The previously recommended 1.2.83 update for a 2022 AutoType bypass is now within the vulnerable range for this new issue.
6Technical deep dive into exploitation
Kirill Firsov of FearsOff discovered the flaw in Fastjson's type resolution path. Attacker-controlled @type values can trigger nested JAR path resolution in Spring Boot fat-JARs, loading malicious bytecode. The @JSONType annotation gets misinterpreted as a trust signal, bypassing type checks. A newer variant exploits /proc/self/fd in recent JDKs for remote JAR fetching. Lab tests confirmed full RCE on JDK 8 and SSRF/JAR download in Tomcat environments.
7Enterprise action plan
1) Scan all dependency trees for Fastjson 1.2.68-83. 2) Enable SafeMode or switch to _noneautotype build. 3) Monitor logs for @type manipulation, unexpected JAR loads, and abnormal process creation. 4) Accelerate Fastjson2 migration plans. 5) Implement strict schema validation at JSON entry points—pay special attention to Object/Map fields as fixed-class binding alone provides insufficient protection.
8Broader industry implications
This incident offers critical lessons in vulnerability management and open-source risk. Research with 300 enterprise leaders highlights growing challenges in AI-driven open-source risk governance and remediation debt. The fact that Alibaba's 2022 AutoType fix is now bypassed underscores that software supply chain security requires continuous vigilance. As development accelerates to machine speed, we must rethink how to maintain sustainable security controls in this new paradigm.