Attackers are actively exploiting a critical flaw in Fastjson, and Alibaba has not released a fixed 1.x version yet.
The vulnerability, tracked as CVE-2026-16723, carries a CVSS score of 9.0 and affects Fastjson versions 1.2.68 through 1.2.83. Because Fastjson is one of the most widely used JSON libraries in the Java ecosystem, the flaw reaches deep into enterprise backends, banking systems, and e-commerce platforms running on Spring Boot. A malicious JSON request sent to a vulnerable application can execute code without any authentication, running with the same privileges as the Java process itself.
| Priority | Action | Detail |
|---|---|---|
| P0 | Enable SafeMode | -Dfastjson.parser.safeMode=true, or ParserConfig.getGlobalInstance().setSafeMode(true), or set in fastjson.properties |
| P0 | Or switch to a noneautotype build | Maven example: com.alibaba:fastjson:1.2.83_noneautotype |
| P1 | Migrate to fastjson2 | Architecturally eliminates this vulnerability; safe under default configuration |
What makes this one dangerous is that it works under stock settings. Older Fastjson bugs required AutoType to be switched on, so most hardened deployments stayed safe. This time the library is exploitable with SafeMode left at its disabled default, and no gadget class on the classpath is needed. Alibaba confirmed the chain across Spring Boot 2.x, 3.x, and 4.x running on JDK 8, 11, 17, and 21.
Alibaba published its advisory on July 21 after responsible disclosure by researcher Kirill Firsov of FearsOff Cybersecurity. Within days, ThreatBook said it had captured exploitation in the wild, while Imperva reported attack traffic aimed at financial services, healthcare, computing, and retail organizations, mostly in the United States, with smaller volumes in Singapore and Canada. Neither firm published victim names or confirmed breaches, so the activity establishes probing rather than proven compromise. Curiously, a July 23 CISA assessment still listed exploitation status as none.
There is no patch to install, which leaves defenders with workarounds only. Alibaba recommends enabling SafeMode through the fastjson.parser.safeMode flag or switching to the restricted 1.2.83_noneautotype build, and it points to Fastjson2 as the permanent fix because that version does not use the same trust path.
Pakistani banks, fintech startups, and government portals lean heavily on Java backends, so local security teams should audit direct and transitive Fastjson dependencies this week rather than waiting for a release that may never arrive.
