FastJson CVE-2026-16723: Audit Your Java JSON Inputs Before They're Exploited

A critical zero-day in FastJson 1.x is being actively exploited against US organizations as of late July 2026. If your Java or Spring Boot application uses any FastJson 1.x version — all the way up to and including 1.2.83 — you need to act now. There is currently no patch for FastJson 1.x.

This guide explains the vulnerability, how to check if you're exposed, and the two mitigation paths available while you wait for (or instead of) an official fix.

What Is CVE-2026-16723?

CVE-2026-16723 is a Remote Code Execution vulnerability in Alibaba's FastJson library, affecting all versions in the 1.x series (1.2.68 through 1.2.83, the final 1.x release). It was disclosed on July 21, 2026, by FastJson maintainers following research from FearsOff Cybersecurity. CVSS score: 9.0 (Critical)

The flaw was confirmed in active exploitation against Spring Boot 2.x, 3.x, and 4.x applications on JDK 8, 11, 17, and 21 — essentially the full stack of production Java deployments.

What makes this particularly dangerous:

• No AutoType required — FastJson's AutoType feature has been the source of past deserialization exploits. Previous advisories told you to disable AutoType and you'd be safe. CVE-2026-16723 exploits a different code path: resource probing on attacker-controlled type names. AutoType being disabled provides no protection.
• No classpath gadget required — Unlike typical deserialization attacks, attackers do not need to find a gadget in your dependencies.
• Default configuration is vulnerable — No special configuration, flag, or usage pattern makes you more vulnerable. Stock FastJson 1.x is affected.

What the Attack Looks Like

The attack vector is a crafted JSON payload sent to any endpoint that uses FastJson to parse untrusted input. When FastJson processes the payload, the malicious type name causes the library to probe external or local resources in a way that enables code execution.

A typical attack path looks like this:

POST /api/data HTTP/1.1
Content-Type: application/json

{"@type":"com.attacker.ExploitClass","payload":"..."}

The library's type resolution logic — even with default configuration — processes the @type field and attempts to load or probe the named class in a way that can be leveraged for RCE.

Confirmed attack vectors include:

• REST API endpoints accepting user-provided JSON bodies
• Message queue consumers parsing JSON payloads from external sources
• Webhook handlers
• Any configuration or data import feature that deserializes JSON via FastJson

Are You Affected?

Run these checks to determine your exposure:

1. Check Your Dependencies

For Maven:

mvn dependency:tree | grep fastjson

For Gradle:

./gradlew dependencies | grep fastjson

If you see com.alibaba:fastjson:1.x.x anywhere in the output — direct or transitive — you are affected.

2. Check Your Fat JAR

If you're distributing Spring Boot executable JARs:

jar tf your-app.jar | grep fastjson

The presence of fastjson-1.*.jar confirms exposure.

3. Check for Transitive Dependencies

Many frameworks include FastJson as a transitive dependency. You may be using FastJson without realizing it. Check:

• Alibaba Druid (database connection pool) — bundles fastjson 1.x by default in older versions
• Dubbo — used FastJson for serialization in older versions
• Spring Cloud Alibaba components — some modules pulled in fastjson 1.x

Even if you never called JSON.parseObject() directly, a transitive dependency might be parsing untrusted JSON with FastJson on your behalf.

Mitigation Option 1: Enable SafeMode (Immediate, Imperfect)

Alibaba's official guidance for FastJson 1.x while an unpatched zero-day exists is to enable SafeMode. This disables support for the @type feature entirely, which blocks the current exploit vector.

JVM argument (add to startup command):

-DFastJson.parser.safeMode=true

Code-level configuration:

import com.alibaba.fastjson.parser.ParserConfig;

// Add this once during application startup
ParserConfig.getGlobalInstance().setSafeMode(true);

Spring Boot application.properties:

spring.fastjson.parser.safe-mode=true

Caveats:

SafeMode breaks any feature that relies on polymorphic deserialization via @type. If your application uses FastJson to deserialize complex object hierarchies with type information, enabling SafeMode will break that functionality. Test in a staging environment before applying to production.

SafeMode does not address all potential attack surfaces — it closes the currently confirmed exploit vector but does not make FastJson 1.x architecturally safe against future research.

Mitigation Option 2: Migrate to FastJson 2 (Recommended Long-Term)

FastJson 2.x is not affected by CVE-2026-16723. The library was rewritten with a fundamentally different architecture:

• Does not perform the same resource probing on attacker-controlled type names
• Uses an allowlist-first approach for polymorphic deserialization
• AutoType is disabled by default and requires explicit opt-in

Migration Steps

Update your dependency:

Maven:

<!-- Remove -->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.83</version>
</dependency>

<!-- Add -->
<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.57</version>
</dependency>

Gradle:

// Remove
implementation 'com.alibaba:fastjson:1.2.83'

// Add
implementation 'com.alibaba.fastjson2:fastjson2:2.0.57'

Update your imports:

FastJson 2 ships a compatibility layer. Add the compat JAR alongside the main library to minimize code changes:

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.57</version>
</dependency>

With the compat layer, most com.alibaba.fastjson.* imports continue working without rewriting call sites.

Verify nothing broke:

// FastJson 1.x call — still works via compat layer
String json = JSON.toJSONString(myObject);
MyObject obj = JSON.parseObject(json, MyObject.class);

Run your full test suite after migration. The most common breakage points are:

• Custom deserializers that relied on @type auto-resolution
• Date format handling (FastJson 2 changed defaults)
• Long type handling for numbers exceeding 2^53 (actually fixed in FastJson 2 — see our post on JSON number precision loss)

Validate Incoming JSON Before Parsing

Regardless of which mitigation you choose, adding a validation layer before FastJson processes any untrusted input reduces your attack surface.

The principle: validate JSON structure and schema before deserializing into domain objects.

A minimal validation wrapper:

import org.json.JSONObject;
import org.json.JSONException;

public class SafeJsonParser {

    public static boolean isStructurallyValid(String input) {
        if (input == null || input.isBlank()) return false;
        try {
            // Basic structural validation using org.json (unaffected by CVE-2026-16723)
            if (input.trim().startsWith("[")) {
                new org.json.JSONArray(input);
            } else {
                new org.json.JSONObject(input);
            }
            return true;
        } catch (JSONException e) {
            return false;
        }
    }

    public static <T> T parseSafely(String input, Class<T> clazz) {
        if (!isStructurallyValid(input)) {
            throw new IllegalArgumentException("JSON structural validation failed before deserialization");
        }
        // If you've enabled SafeMode or migrated to fastjson2, proceed
        return JSON.parseObject(input, clazz);
    }
}

This catches malformed payloads before they reach FastJson's type resolution logic. It also catches the class of broken JSON that results from LLM outputs, API truncation, or encoding issues — you can use AI JSONMedic's repair tool to clean those before they reach your parsing pipeline.

For online validation of suspicious payloads before testing in your environment, the JSON Validator processes everything client-side with no server transmission.

What If You Can't Migrate Immediately?

Not all teams can migrate libraries in a sprint. If you're in a regulated environment, have extensive test coverage to rewrite, or are managing a legacy system with a longer change cycle:

1. Enable SafeMode now — this closes the confirmed exploit vector with one line of configuration
2. Add input length limits — reject payloads above a reasonable size threshold before they reach FastJson
3. Add @type string filtering at the HTTP layer — if your application does not use polymorphic deserialization, reject any JSON payload containing the literal string @type at the WAF or servlet filter level
4. Monitor logs for exploitation attempts — look for requests with @type fields pointing to unusual class names (e.g., classes in java.lang, com.sun, or org.springframework packages)
5. Schedule migration for the next sprint — SafeMode buys you time, not permanent safety

Timeline of FastJson Security Incidents

CVE-2026-16723 is not FastJson 1.x's first critical vulnerability. The library has a documented history:

The pattern is clear: FastJson 1.x deserialization is fundamentally unsafe for untrusted input. CVE-2026-16723 is not a one-off — it reflects architectural decisions in FastJson 1.x that cannot be safely patched without a rewrite. The rewrite is FastJson 2.

Frequently Asked Questions

Q: I disabled AutoType years ago after the 2022 incidents. Am I still vulnerable?

A: Yes. CVE-2026-16723 does not use the AutoType mechanism. It exploits a different code path in FastJson 1.x's type resolution. Disabling AutoType provides no protection against this vulnerability.

Q: We use FastJson only for serialization (Java objects to JSON strings), not deserialization. Are we affected?

A: The serialization direction — JSON.toJSONString() — is not the attack vector. The vulnerability requires FastJson to parse attacker-controlled JSON as input. If you can confirm that no untrusted input is ever passed to JSON.parseObject(), JSON.parse(), or similar deserialization calls, your serialization-only usage is not directly affected. However, validate this assumption thoroughly, including transitive usage.

Q: Is Spring Boot itself vulnerable if it doesn't explicitly depend on FastJson?

A: Spring Boot's default JSON library is Jackson, which is not affected. If your project only uses Jackson, you are not exposed. Only projects with explicit or transitive FastJson 1.x dependencies are at risk.

Q: When will Alibaba release a patch for FastJson 1.x?

A: As of August 4, 2026, no patch has been released and no patch timeline has been announced. Alibaba's guidance is to enable SafeMode as a temporary measure and migrate to FastJson 2.x. Do not wait for a 1.x patch — plan the migration.

Q: We found FastJson 1.x as a transitive dependency of Druid or another library we use. What do we do?

A: For Alibaba Druid specifically, you can override the transitive FastJson version and force SafeMode via the JVM argument — Druid's FastJson usage is primarily for serialization and the SafeMode restriction generally does not break it. Longer term, check if the newer versions of the library you depend on have updated to FastJson 2.x as a dependency, and upgrade your dependency to get the updated transitive version.