A critical remote code execution (RCE) vulnerability has been identified in Fastjson, a widely used JSON processing library for Java applications. This flaw, designated as CVE-2026-16723 with a CVSS score of 9.0, affects versions 1.2.68 through 1.2.83 of Fastjson. Notably, this vulnerability is exploitable under the library’s default configuration, without the need for enabling AutoType or the presence of third-party gadget classes.
Fastjson, developed by Alibaba, is an open-source library that facilitates the serialization and deserialization of Java objects to and from JSON. The vulnerability is particularly concerning for applications deployed using Spring Boot’s executable fat JARs across various versions, including Spring Boot 2.x, 3.x, and 4.x, and JDK versions 8, 11, 17, and 21. Exploitation can occur when an attacker sends a specially crafted JSON payload to a vulnerable application, potentially leading to arbitrary code execution without authentication.
Security firms have observed active exploitation of this vulnerability. ThreatBook reported capturing in-the-wild exploitation attempts, indicating that attackers are targeting systems running affected versions of Fastjson. Similarly, Imperva noted that attacks are primarily focused on organizations in the United States, with some activity in Singapore and Canada. The majority of these attacks originate from browser impersonators, while tools written in Ruby and Go account for approximately 30% of the observed attacks.
As of July 25, 2026, no patched version of Fastjson 1.x has been released to address this vulnerability. Organizations utilizing affected versions are strongly advised to take immediate action to mitigate the risk. Enabling SafeMode is a critical step, which can be achieved by setting the system property -Dfastjson.parser.safeMode=true. Additionally, Alibaba recommends migrating to Fastjson 2.x as a long-term solution, as the 1.x branch is no longer actively maintained.
It’s important to note that while enabling SafeMode provides a temporary safeguard, it should not be considered a permanent fix. Organizations should prioritize updating their applications to use the latest version of Fastjson to ensure comprehensive protection against potential exploits.
This vulnerability underscores the importance of maintaining up-to-date software dependencies and implementing robust security measures. Organizations should regularly review their software components for known vulnerabilities and apply patches or updates promptly. Additionally, employing web application firewalls and intrusion detection systems can provide an additional layer of defense against exploitation attempts.
Given the active exploitation of this vulnerability and the absence of a patched version for Fastjson 1.x, organizations must act swiftly to secure their systems. Monitoring for unusual activity, applying recommended mitigations, and planning for an upgrade to Fastjson 2.x are essential steps in safeguarding against potential attacks.
