Fastjson 1.x RCE Vulnerability Targeted in Attacks: Early Warning
An unpatched critical remote code execution vulnerability in Alibaba's Fastjson 1.x JSON library for Java is reportedly being targeted in attacks. Spring Boot applications using affected versions may be vulnerable to unauthenticated code execution.
What happened
Security firms ThreatBook and Imperva have reported that attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can reportedly execute code without authentication, with the privileges of the Java process. The vulnerability, tracked as CVE-2026-16723, carries an Alibaba-assigned CVSS score of 9.0. As of July 25, Alibaba had not released a fixed Fastjson 1.x version.
The vulnerability requires Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default. Organizations that cannot migrate immediately should enable SafeMode with -Dfastjson.parser.safeMode=true or use com.alibaba:fastjson:1.2.83_noneautotype. Alibaba lists migration to Fastjson2 as the long-term fix.
To assess exposure, check if your Spring Boot applications use Fastjson 1.x versions 1.2.68 through 1.2.83. If so, evaluate if there are any network-reachable paths that send untrusted JSON to a Fastjson parser with SafeMode disabled. Monitor for any suspicious activity and prepare to upgrade to a non-vulnerable version of fastjson as soon as it becomes available.
How 0Day mitigates this
fastjson is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.