Security firms ThreatBook and Imperva say attackers have identified a critical flaw in Fastjson, Alibaba’s JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with Java process permissions.
Tracked as CVE-2026-16723the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The verified chain requires Fastjson 1.2.68 through 1.2.83, the Spring Boot executable fat-JAR, a network-accessible method that sends attacker-controlled JSON to the affected analyzer, and SafeMode left at its disabled default. AutoType can always be disabled, and no classpath gadget is required.
As of July 25, Alibaba had not yet released a stable version of Fastjson 1.x. Organizations that cannot migrate quickly should enable SafeMode with -Dfastjson.parser.safeMode=true or use com.alibaba:fastjson:1.2.83_noneautotype. Alibaba lists the move to Fastjson2 as a long-term fix.
Alibaba published its advisory on July 21 following a responsible disclosure by Kirill Firsov of FearsOff Cybersecurity. The maintainers described the vulnerability as requiring “no AutoType enabled” and “no classpath widget.” They have validated the series on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21.
Firsov traced the issue to Fastjson’s way of resolving the type. A controlled attacker @type value can be changed to refer to the class resource. In Spring Boot fat-JAR compatibility, the nested JAR method can download attacker-controlled bytecode. An @JSONType annotation on that resource can then be treated as a trust signal, allowing the class to pass Fastjson type checking and loading.
His technical analysis also describes a new JDK method that downloads a remote JAR and references it /proc/self/fd.
The exploit depends on the Spring Boot loader for the fat-JAR executable. Alibaba lists non-fat JARs, uber-standard JARs, and Tomcat or Jetty WAR deployments as unaffected. Accessible entrances include JSON.parse, JSON.parseObject(String)again JSON.parseObject(String, Class). A binding entry in the focus section is not sufficient if the object contains i Object or Map a field where a payload can be entered.
ThreatBook said on July 22 that its platform caught the wild exploit after adding detection support two days earlier. Its laboratory results were minimal: it reproduced the full code implementation of the Spring Boot fat-JAR in JDK 8, while its embedded Tomcat test produced only remote JAR downloads or server-side application manipulation.
Imperva reported activity against financial services, health care, computer, retail, and other organizations, mostly in the United States, with smaller volumes in Singapore and Canada. It said browser actors generated the most requests, while Ruby and Go tools represented about 30% combined.
There are no vendor-published attack statistics, raw claims, execution evidence, named victims, or confirmed compromises. Their reports establish observed exploit activity, not evidence of successful code execution against a real-world target or breach.
The July 23 CISA-ADP test however marked the exploit as none. Hacker News confirmed on July 25 that the flaw was not in CISA’s Current Vulnerability Catalog. Available sources do not explain the discrepancy.
Hacker News also found that there are no Fastjson 1.x patched artifacts in the project’s GitHub tags or in the Maven Central repository as of July 25th. 1.2.83_noneautotype remains a limited property available.
Organizations should inventory Fastjson direct and variable dependencies and scan affected systems for suspicious ones @type values, nested JAR URLs, unexpected outgoing connections, child processes, file changes, and web shells. Fastjson2 is not affected because it does not use the same or annotation-based resource authentication method.
Hacker News reached out to Alibaba for clarification on the affected versions and patch plans for Fastjson 1.x, and to Imperva for details on the functionality of the reported exploit. We will update the story with any feedback.
Fastjson 1.2.83 was Alibaba’s recommended development for the AutoType bypass variant disclosed in 2022. That last 1.x release is now within the affected range CVE-2026-16723.
