A critical vulnerability in FastJson, identified as CVE-2026-16723, is being exploited against organizations in the United States, putting Java applications that process untrusted JSON at immediate risk.
This flaw has a CVSS severity score of 9.0 and affects FastJson versions ranging from 1.2.68 to 1.2.83, which is the final release line of FastJson 1.x.0
FastJson is an open-source Java library originally developed by Alibaba for converting Java objects to JSON and for parsing JSON data back into Java objects.
The issue was disclosed on July 21, 2026, by FastJson maintainers following research conducted by FearsOff Cybersecurity. It has been confirmed in Spring Boot applications packaged as executable fat JAR files, including deployments running Spring Boot 2.x, 3.x, and 4.x on JDK versions 8, 11, 17, and 21.
FastJson RCE 0-Day Vulnerability
The vulnerability is particularly severe because attackers do not need valid credentials, user interaction, AutoType enabled, or any third-party deserialization gadgets in the target application’s classpath to exploit it.
A vulnerable server can be attacked simply by processing malicious JSON using standard methods like JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Attackers exploit FastJson’s handling of the @type JSON field, which indicates a Java class to instantiate during deserialization.
While FastJson 1.x attempts to restrict dangerous class loading by disabling AutoType by default, researchers have discovered a bypass in the library’s internal type-resolution process.
In affected Spring Boot fat-JAR deployments, crafted JSON can trigger resource lookups based on an attacker-controlled class name. Threat actors can leverage nested JAR URL handling to bypass standard type restrictions and reach a code-execution path.
Additionally, FastJson 1.x treats the presence of the @JSONType annotation as a trust signal, enabling malicious input to circumvent existing protections. Successful exploitation allows a remote attacker to execute arbitrary commands with the same permissions as the Java application.
This can lead to the deployment of web shells or malware, data theft, credential collection, persistence creation, lateral movement within a network, or complete control over the underlying server.
Exploitation attempts are being observed across various industries, including financial services, healthcare, retail, computing, and business services.
Imperva reports that while most attacks have targeted U.S. organizations, smaller campaigns have also been observed in Singapore and Canada, with broader exploitation expected as public PoC details become widely available.
Many requests utilize browser-like user-agent strings to blend in with normal traffic. However, tools developed in Ruby and Go account for approximately 30% of the observed exploit traffic, indicating that automated scanning and exploitation frameworks are also in use.
FastJson 2.x is not affected by CVE-2026-16723 due to its architecture, which does not perform the same resource probing on attacker-controlled type names and employs an allowlist-first approach for polymorphic deserialization.
Organizations are urged to immediately enable FastJson SafeMode by using the command -DFastJson.parser.safeMode=true, or by setting ParserConfig.getGlobalInstance().setSafeMode(true).
Security teams should identify both direct and transitive FastJson dependencies, search logs for suspicious @type, jar:http, and jar:file values, and investigate any unexpected commands, outbound connections, unauthorized file modifications, and web shells.
Since FastJson 1.x is no longer actively maintained and no patch is available for this issue, affected organizations should prioritize migrating to FastJson 2.x after conducting compatibility testing.
