Critical Fastjson RCE Exposes Common Spring Boot Deployments
CVE-2026-16723 affects Fastjson 1.2.68 through 1.2.83 and can allow unauthenticated remote-code execution under the library’s default configuration when applications run as Spring Boot executable fat JARs.
Why it matters: The flaw can bypass assumptions built around AutoType mitigation and places a common Java deployment pattern inside the affected scope.
This is the kind of vulnerability teams miss because they believe an old mitigation still protects them.
CVE-2026-16723 affects Fastjson versions 1.2.68 through 1.2.83. Alibaba’s advisory says an unauthenticated attacker can achieve remote-code execution under the stock default configuration when the application runs as a Spring Boot executable fat JAR, the common deployment model launched with java -jar.
The important detail is what the attacker does not need. AutoType does not have to be enabled, and a separate classpath gadget is not required. Organizations that disabled AutoType years ago may incorrectly assume they are outside the blast radius.
Fastjson 1.x is no longer supported, and there is no conventional patched 1.x release to wait for. Alibaba recommends enabling SafeMode, using the 1.2.83_noneautotype build or migrating to Fastjson2. Fastjson2 is not affected by this specific flaw.
SecurityWeek reported that attackers are exploiting the vulnerability. Alibaba’s official advisory documents the flaw and remediation but does not confirm observed attacks, so the exploitation claim should remain attributed rather than stated as independently verified.
The immediate work is inventory, not debate. Search dependency manifests, container images and Spring Boot services for Fastjson 1.x. Prioritize internet-facing applications and anything that parses untrusted JSON.
Unsupported libraries do not disappear when a development team stops thinking about them. They remain in production until someone proves otherwise.