# Critical RCE Vulnerability in Fastjson 1.x Actively Exploited in Attacks

Unpatched flaw in Alibaba's Java JSON library allows remote code execution in Spring Boot applications.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-07-25
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html>
- **On Brifing:** https://brifing.si/s/095dcda6-164d-4696-9e38-d094d0279796

## Vulnerability details and scope

Tracked as CVE-2026-16723, this vulnerability affects Fastjson versions 1.2.68 through 1.2.83. In Spring Boot fat-JAR deployments, it enables unauthenticated code execution with Java process privileges. Attackers can manipulate @type values to trigger class resource lookups. The vulnerability remains exploitable even with AutoType disabled and SafeMode at default off setting. Alibaba assigned a CVSS score of 9.0 to this flaw.

## Affected systems and components

Only Spring Boot executable fat-JAR distributions are vulnerable. Standard JARs, uber-JARs, and Tomcat/Jetty WAR deployments remain unaffected. Attack vectors include accessible endpoints like JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). The exploit chain has been verified on Spring Boot 2.x, 3.x, and 4.x running JDK 8, 11, 17, and 21. Fastjson2's different architecture makes it immune to this vulnerability.

## Mitigation measures and long-term solutions

Alibaba recommends migrating to Fastjson2 as the permanent fix. Immediate workarounds include enabling SafeMode via -Dfastjson.parser.safeMode=true or using the 1.2.83_noneautotype build. Organizations should inventory all Fastjson dependencies (direct and transitive) and scan systems for suspicious @type values, nested JAR URLs, unexpected outbound connections, and web shells.

## Observed attack activity

ThreatBook reported in-the-wild exploitation on July 22. Imperva observed attacks primarily targeting US-based financial services, healthcare, retail, and computing organizations, with smaller volumes in Singapore and Canada. Approximately 70% of attacks came from browser-impersonating tools, while Ruby and Go scripts accounted for 30%. No confirmed breaches or named victims have been disclosed yet.

## Patch status and institutional response

As of July 25, no patched Fastjson 1.x version has been released. Version 1.2.83 remains the latest stable release in GitHub tags and Maven Central. Interestingly, CISA's Known Exploited Vulnerabilities catalog doesn't include this flaw despite vendor confirmations. The previously recommended 1.2.83 update for a 2022 AutoType bypass is now within the vulnerable range for this new issue.

## Technical deep dive into exploitation

Kirill Firsov of FearsOff discovered the flaw in Fastjson's type resolution path. Attacker-controlled @type values can trigger nested JAR path resolution in Spring Boot fat-JARs, loading malicious bytecode. The @JSONType annotation gets misinterpreted as a trust signal, bypassing type checks. A newer variant exploits /proc/self/fd in recent JDKs for remote JAR fetching. Lab tests confirmed full RCE on JDK 8 and SSRF/JAR download in Tomcat environments.

## Enterprise action plan

1) Scan all dependency trees for Fastjson 1.2.68-83. 2) Enable SafeMode or switch to _noneautotype build. 3) Monitor logs for @type manipulation, unexpected JAR loads, and abnormal process creation. 4) Accelerate Fastjson2 migration plans. 5) Implement strict schema validation at JSON entry points—pay special attention to Object/Map fields as fixed-class binding alone provides insufficient protection.

## Broader industry implications

This incident offers critical lessons in vulnerability management and open-source risk. Research with 300 enterprise leaders highlights growing challenges in AI-driven open-source risk governance and remediation debt. The fact that Alibaba's 2022 AutoType fix is now bypassed underscores that software supply chain security requires continuous vigilance. As development accelerates to machine speed, we must rethink how to maintain sustainable security controls in this new paradigm.

## Sources covering this story

- https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._