Critical Fastjson 1.x flaw lets attackers run code in Spring Boot apps with no patch available

A critical remote code execution vulnerability in Fastjson 1.x, Alibaba's widely used JSON serialization library for Java, is being actively exploited in the wild, according to reporting by The Hacker News. The flaw, tracked as CVE-2026-16723 and carrying a CVSS score of 9.0, affects Fastjson versions 1.2.68 through 1.2.83 and lets an attacker execute arbitrary code with the privileges of the Java process — without authentication, without needing Fastjson's AutoType feature enabled, and without relying on third-party gadget classes that past Fastjson exploits typically required.

How the exploit chain works

The vulnerability targets Spring Boot applications deployed as executable "fat-JARs" — the self-contained, all-in-one JAR format Spring Boot commonly produces for deployment. Exploitation has been confirmed across Spring Boot 2.x, 3.x, and 4.x, running on JDK versions 8, 11, 17, and 21, which covers the overwhelming majority of Java shops still running Fastjson 1.x in production.

The attack works by sending a crafted JSON request containing a manipulated @type value, which triggers Fastjson's type-resolution logic to perform a class-resource lookup. Inside a compatible Spring Boot fat-JAR, a specially constructed nested JAR path can then fetch attacker-controlled bytecode. An accompanying @JSONType annotation on that resource is treated by Fastjson as a trust signal, letting the malicious class bypass Fastjson's type-checking safeguards entirely and load into the running application. Because the exploit works under Fastjson's default configuration — SafeMode is off by default — any unpatched, internet-facing Spring Boot service using an affected Fastjson version is potentially exploitable without any special configuration on the attacker's part.

No patch, but mitigations exist

As of July 25, 2026, Alibaba has not released an official patch for the Fastjson 1.x branch specifically. Security teams have three practical options in the meantime. The first is enabling SafeMode directly via the system property -Dfastjson.parser.safeMode=true, which blocks the type-resolution behavior the exploit depends on. The second is switching to the specific package variant com.alibaba:fastjson:1.2.83_noneautotype, which strips AutoType-related functionality entirely. The third, and the option Alibaba is recommending as the long-term fix, is migrating off Fastjson 1.x to Fastjson2, the actively maintained successor library.

What's not affected

The specific exploit chain requires the fat-JAR deployment format Spring Boot uses by default — plain non-fat JARs, generic uber-JARs built with tools like Maven Shade, and applications deployed as WAR files inside Tomcat or Jetty are not vulnerable to this particular attack path, since they don't expose the nested JAR class-resource lookup the exploit relies on. That narrows the affected population but doesn't eliminate the risk: fat-JAR deployment is the default and most common packaging choice for Spring Boot applications specifically because it simplifies deployment to a single executable file.

Why this matters beyond one library

Fastjson has a long history of serious deserialization vulnerabilities dating back nearly a decade, and Fastjson 1.x remains widely deployed in production Java systems despite Alibaba's own recommendation to migrate to Fastjson2. Organizations running Spring Boot fat-JAR deployments with Fastjson 1.x in the 1.2.68–1.2.83 range should treat this as an emergency patching priority: enable SafeMode immediately as a stopgap, and treat the migration to Fastjson2 as urgent rather than optional, since Alibaba's decision not to patch the 1.x branch suggests future vulnerabilities in that line are also unlikely to be fixed.