Fastjson 1.x RCE (CVE-2026-16723) Is Under Active Attack — No Patch Yet

Fastjson is Alibaba's JSON library for Java, and it has a long history of deserialization problems tied to its AutoType feature. This one is different: researchers say the new flaw, tracked as CVE-2026-16723, is exploitable without enabling AutoType and without a classpath gadget — the two preconditions that usually gate Fastjson RCE chains.

What the attack chain actually requires

Per reporting from The Hacker News, the confirmed chain needs four things: Fastjson in the 1.2.68–1.2.83 range, the application packaged as a Spring Boot executable fat-JAR, a network-reachable endpoint that hands attacker-controlled JSON to the parser, and SafeMode left at its default disabled state. Where that lines up, a malicious JSON request executes arbitrary code with the privileges of the Java process — no login required.

Alibaba assigned the flaw a CVSS score of 9.0. Fastjson2, the actively maintained successor library, is not affected.

Who's being hit

Imperva's writeup and ThreatBook both report active exploitation in the wild. Targeted sectors span financial services, healthcare, computing, retail, and general business, with the overwhelming majority of observed activity against US-based organizations and smaller amounts in Singapore and Canada. Kirill Firsov of FearsOff Cybersecurity carried out responsible disclosure on July 21, with Alibaba's own disclosure published the same day.

No patched 1.x release — what to do now

As of July 25, 2026, Alibaba has not shipped a fixed Fastjson 1.x version; 1.2.83 remains the latest standard release. That leaves mitigation, not patching, as the near-term move for teams still on 1.x:

• Enable SafeMode explicitly: -Dfastjson.parser.safeMode=true (it is disabled by default).
• Where possible, move to the hardened com.alibaba:fastjson:1.2.83_noneautotype build.
• Treat migration to Fastjson2 as the actual fix, not a someday item — Fastjson2 is confirmed unaffected.
• Inventory which internet-facing Spring Boot services are shipped as fat-JARs and parse untrusted JSON with Fastjson 1.x; that's the exposure surface this chain needs.

Fastjson's history with AutoType-based deserialization RCEs means many teams already have detection and mitigation muscle memory for this library. The catch here is that the usual AutoType-focused defenses don't fully cover this chain, since neither AutoType nor a gadget class is a prerequisite — SafeMode is the control that actually matters.

Why it matters beyond Fastjson

This is a reminder that a library's worst-known vulnerability class (AutoType deserialization, in Fastjson's case) can produce siblings that don't fit the same detection assumptions. Unauthenticated, pre-auth RCE in a JSON parser sitting behind any internet-facing Spring Boot endpoint is about as high-severity as web application risk gets — and with no vendor patch yet, compensating controls are the only lever most operators have.