Fastjson 1.x RCE Vulnerability Targeted in Attacks
Attackers are targeting a critical remote code execution vulnerability in Alibaba's Fastjson JSON library for Java. Affected Spring Boot applications can have code executed without authentication via a malicious JSON request.
What happened
Security firms ThreatBook and Imperva have confirmed that attackers are exploiting a critical flaw in Fastjson versions 1.2.68 through 1.2.83. The vulnerability, tracked as CVE-2026-16723, allows remote code execution without authentication in affected Spring Boot applications. As of July 25, Alibaba had not released a fixed Fastjson 1.x version. Organizations should enable SafeMode or use com.alibaba:fastjson:1.2.83_noneautotype as temporary mitigations. Long-term fix is migration to Fastjson2.
The vulnerability requires Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default. AutoType can remain disabled, and no classpath gadget is required. The issue was traced to Fastjson's type-resolution path, where an attacker-controlled @type value can be turned into a class-resource lookup.
As the vulnerability is being actively exploited in the wild with no patch available, organizations using affected versions of Fastjson in Spring Boot applications should implement the recommended mitigations immediately and monitor for any suspicious activity. The primary sources should be consulted for the most up-to-date information and guidance.
How 0Day mitigates this
fastjson is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.