Fastjson 1.x CVE-2026-16723: a critical RCE with no patch, actively exploited

> In short: CVE-2026-16723 is a critical remote code execution flaw (CVSS 9.0) in Alibaba's Fastjson 1.2.68 through 1.2.83, the Java JSON library. On an affected Spring Boot executable fat-JAR, a malicious JSON request runs code with the privileges of the Java process — no AutoType enablement, no classpath gadget, no authentication. As of July 25, 2026, no patched 1.x release exists. Mitigation: enable SafeMode or migrate to Fastjson2.

Why this matters to you

Fastjson is one of the most widely used JSON libraries in the Java ecosystem. If your backend (or a partner's, or a client's) is Java/Spring, there is a real chance it pulls Fastjson transitively. This CVE sits in the direct lineage of Log4Shell and Spring4Shell: a ubiquitous Java library, a default config that is unsafe, and an exploitation path that needs no authentication.

The distinctive angle here is that the maintainer has no 1.x patch. The official recommendation is to migrate to Fastjson2 — a multi-week engineering task for most teams, not a one-line dependency bump. In the meantime, every exposed Fastjson 1.2.68–1.2.83 endpoint is a live target.

The flaw in two sentences

The bug is in Fastjson's type-resolution path. An attacker-controlled @type value is turned into a class-resource lookup, and on a Spring Boot fat-JAR a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType annotation inside that resource is treated as a trust signal, allowing the class to pass Fastjson's type checks and load — achieving code execution.

Critically, AutoType does not need to be enabled and no gadget class needs to exist on the classpath. That removes the two controls most teams thought protected them. The chain was reproduced on Spring Boot 2.x, 3.x, and 4.x across JDK 8, 11, 17, and 21. Entrypoints include JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class) — and binding input to a fixed class is not enough if an Object or Map field lets the payload nest.

What makes it worse than a normal RCE

Three aggravating factors stack up:

What to do

The pattern this confirms

Fastjson CVE-2026-16723 is the third reminder in five years that "parse untrusted JSON with a library that resolves attacker-controlled types" is a fundamentally unsafe default. Log4Shell taught us about JNDI, Spring4Shell about data binding, and now Fastjson reminds us that even with AutoType off, the type-resolution path itself is attack surface. For a SaaS vendor, the lesson is operational: any deserialization library that has had two serious RCEs in its lifetime belongs on a watchlist with a migration plan already written.