Skip to content

Fastjson CVE-2026-16723 active exploitation

Summary

On 2026-07-21, Alibaba published a critical advisory for CVE-2026-16723, an unauthenticated remote-code-execution path in Fastjson 1.2.68 through 1.2.83. A network-reachable application that parses attacker-controlled JSON can be exploitable under Fastjson's stock configuration when it runs as a Spring Boot executable fat JAR and SafeMode is disabled. AutoType does not need to be enabled and no pre-existing classpath gadget is required.

ThreatBook reported capturing in-the-wild exploit traffic after adding detection on July 20. Imperva separately reported attempts against financial-services, healthcare, computing, retail, and other organizations, concentrated in the United States with lower volume in Singapore and Canada. Neither source published request counts, confirmed victims, raw execution evidence, or evidence of a successful compromise. Treat this as observed active exploitation attempts, not proof that every request achieved code execution.

No patched Fastjson 1.x release was publicly available when the sources were checked on 2026-07-25. Alibaba recommends enabling SafeMode or using the 1.2.83_noneautotype build immediately, then migrating to Fastjson2.

Tags

Why this matters

  • The affected path can execute code with the Java process's privileges without authentication or user interaction.
  • Disabling AutoType is not sufficient; the vulnerable configuration uses AutoType off and SafeMode off, which Alibaba describes as the stock defaults.
  • Binding input to a target DTO is not a complete mitigation if an attacker can nest the payload in an Object- or Map-typed field.
  • Version 1.2.83 is both the last standard 1.x release and inside the vendor-confirmed affected range. A normal upgrade within the 1.x line therefore does not remove exposure.
  • Fastjson can be present transitively, so source manifests alone may miss vulnerable applications or packaged copies.

Confirmed exposure conditions

All of the following are relevant to the vendor-confirmed chain:

Condition Exposure detail
Fastjson 1.2.68 through 1.2.83
Configuration SafeMode disabled; AutoType may remain disabled
Packaging Spring Boot executable fat JAR launched with java -jar
Tested platforms Spring Boot 2.x, 3.x, and 4.x; JDK 8, 11, 17, and 21
Reachability Attacker-controlled JSON reaches JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class)

Alibaba lists Fastjson2, SafeMode-enabled deployments, noneautotype builds, non-fat-JAR deployments, and Fastjson 1.2.60 or earlier as outside this specific chain. Plain or generic uber-JAR and Tomcat or Jetty WAR deployments do not satisfy the vendor-described trigger condition. These exclusions apply to this vulnerability path and should not be treated as a statement that older Fastjson releases are generally safe.

ThreatBook reported a narrower lab result: it reproduced full RCE in a Spring Boot fat JAR on JDK 8, while its embedded-Tomcat test produced a remote-JAR fetch or SSRF but not full execution. Alibaba reports end-to-end verification across the broader Spring Boot and JDK matrix above. Preserve that distinction when validating a specific deployment.

Technical characteristics

  1. An attacker supplies a crafted @type value in JSON accepted by an affected parser entry point.
  2. Fastjson 1.x type resolution performs a class-resource lookup using attacker-controlled class-name material.
  3. In a compatible Spring Boot executable fat JAR, a crafted nested-JAR path can retrieve attacker-controlled bytecode.
  4. An @JSONType annotation in the retrieved resource is treated as a trust signal, bypassing normal type restrictions.
  5. The attacker-controlled class loads and executes in the application process.

The public researcher analysis also describes a newer-JDK path that retrieves a remote JAR and references it through /proc/self/fd. Fastjson2 removes the relevant resource-probing and annotation-as-trust design and uses an allowlist-first type-resolution model.

Defender actions

  1. Inventory packaged applications, not only dependency files. Search SBOMs, Maven and Gradle resolution output, container images, deployed JARs, and extracted Spring Boot layers for com.alibaba:fastjson 1.2.68–1.2.83. Include transitive dependencies and internally repackaged artifacts.
  2. Identify exploitable deployment shape. Confirm whether each application is a Spring Boot executable fat JAR, whether attacker-controlled JSON reaches an affected parse method, and whether SafeMode is actually enabled at runtime.
  3. Apply an immediate control. Set -Dfastjson.parser.safeMode=true, call ParserConfig.getGlobalInstance().setSafeMode(true), or set fastjson.parser.safeMode=true in fastjson.properties. Alternatively, use com.alibaba:fastjson:1.2.83_noneautotype where compatibility permits.
  4. Migrate to Fastjson2. Treat SafeMode, the noneautotype build, and WAF rules as interim risk reduction. Test application compatibility and move off the unmaintained 1.x line.
  5. Restrict ingress and egress while remediating. Limit JSON endpoints to required callers and block unnecessary application-server egress, especially remote JAR retrieval and unexpected outbound HTTP/S.
  6. Hunt exploit traffic. Review application, reverse-proxy, WAF, and packet telemetry for unusual @type values, nested jar: URLs, remote JAR retrieval, and repeated malformed JSON. ThreatBook specifically called out strings beginning @type":"jar:file:. and @type":"jar:http:..; do not rely on exact-string blocking alone because encoding and parser variations can evade brittle signatures.
  7. Hunt post-exploitation. Investigate child processes from Java, shell or download utilities, new files or web shells, unexpected outbound connections, credential and configuration reads, new scheduled tasks or services, and lateral movement from the application identity.
  8. Preserve evidence before rebuilding. Capture process trees, open files and sockets, JVM arguments, container and image identifiers, deployed JAR hashes, relevant logs, and volatile evidence. If execution is supported, isolate the host, rotate application and reachable service credentials, and rebuild from trusted artifacts.

Exploitation-status caveats

  • ThreatBook and Imperva reported attack traffic, but neither disclosed enough public evidence to independently establish successful code execution or confirmed victim compromise.
  • ThreatBook's initial scope said Fastjson versions through 1.2.83, while Alibaba's authoritative advisory limits this path to 1.2.68–1.2.83. Use the vendor range for this CVE and assess older 1.x versions for their separate known weaknesses.
  • CVE-2026-16723 was not in CISA's KEV catalog when checked on 2026-07-25. Absence from KEV does not negate the two vendors' observed-attempt reporting.
  • Browser impersonation and Ruby/Go client proportions reported by Imperva are traffic characteristics, not actor attribution.

Sources