- java
- fastjson
- rce
- cve
- spring-boot
- deserialization
- itw
news
Fastjson 1.x Spring Boot Fat-JAR RCE (CVE-2026-16723)
Default-config RCE in fastjson 1.2.68–1.2.83 on Spring Boot fat-JARs; ITW since late July; fix in 1.2.84 or SafeMode / migrate to fastjson2.
Summary
CVE-2026-16723 is a critical remote code execution flaw in Alibaba fastjson 1.2.68 through 1.2.83 (including the final 1.x release before the fix train). It is exploitable under stock defaults — AutoType off, SafeMode off — when the app runs as a Spring Boot executable fat-JAR (java -jar). No third-party gadget classpath is required.
Alibaba published the advisory on 2026-07-21 (updated 2026-07-29). Discovery credit: Kirill Firsov / FearsOff. ThreatBook and Imperva reported active exploitation against U.S. and other orgs (financial, healthcare, retail, computing) in the following week. Public PoC index cards appear on Sploitus.
Fixed in fastjson 1.2.84. All fastjson2 versions are not affected by this CVE. OFFSITE.DARK indexes vendor advisory and Sploitus listings only.
Technical Details
| Aspect | Detail |
|---|---|
| CVE | CVE-2026-16723 |
| Library | com.alibaba:fastjson 1.2.68 – 1.2.83 |
| Root cause | Type-resolution path probes attacker-controlled type names (getResourceAsStream / related) before AutoType restrictions fully apply; @JSONType used as a false trust signal in 1.x |
| Config | Default: AutoType OFF + SafeMode OFF |
| Deployment trigger | Spring Boot executable fat-JAR |
| Entry points | JSON.parse, JSON.parseObject(String), JSON.parseObject(String, Class) |
| Verified | Spring Boot 2.x/3.x/4.x; JDK 8/11/17/21 |
Not a mitigation: specifying a DTO class — payloads can nest inside Object / Map fields.
Not affected: fastjson ≥ 1.2.84; all fastjson2; SafeMode=true; noneautotype builds; non-fat-jar WAR/uber layouts that miss the trigger; fastjson ≤ 1.2.60.
CVE
| Field | Value |
|---|---|
| CVE | CVE-2026-16723 |
| CVSS | 9.0 Critical (Alibaba) |
| Fixed | fastjson 1.2.84 |
| ITW | Confirmed (ThreatBook / Imperva reporting) |
| CISA KEV | Not listed as of late-July industry notes (monitor) |
Impact
Pre-auth RCE on common Spring Boot fat-JAR deployments still on fastjson 1.x. Blast radius is high because 1.x remained widely embedded after maintainers shifted focus to fastjson2. Early reporting noted a window where some trackers still showed “no exploitation” despite vendor telemetry — treat as actively exploited regardless.
Mitigation
- Upgrade to
com.alibaba:fastjson:1.2.84immediately, or - Enable SafeMode:
-Dfastjson.parser.safeMode=true/ParserConfig.getGlobalInstance().setSafeMode(true), or - Use a noneautotype 1.x build, or
- Migrate to fastjson2 (≥ 2.0.63 recommended for separate AutoType hardening).
- Inventory Maven/Gradle trees for
com.alibaba:fastjson1.2.68–1.2.83 in fat-JAR services. - WAF: inspect JSON
@type/ nested JAR URL patterns (Imperva and peers ship rules — not a substitute for upgrade).