Remote Code Execution in Fastjson 1.2.68 to 1.2.83

Executive Summary

CVE-2026-16723 is a remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. It allows attackers to execute arbitrary code on a target system by exploiting unsafe type resolution paths in the library. The vulnerability is triggered through common JSON parsing methods like JSON.parse and does not require AutoType or classpath gadgets to exploit.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-16723, check if your system runs fastjson versions 1.2.68 through 1.2.83 in a Spring Boot fat-jar deployment. Inspect application logs for suspicious JSON parsing activity or unexpected class loading. Use commands like 'java -jar your-app.jar -Dfastjson.parser.safeMode=true' to test SafeMode compatibility.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete system compromise if exploited. Attackers can gain control over the affected application, steal sensitive data, install malware, or perform other malicious activities. Systems running Spring Boot applications as fat-jars are particularly at risk, as the attack can be initiated through standard JSON parsing entry points.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability in fastjson 1.2.68-1.2.83 can lead to unauthorized code execution, potentially exposing sensitive data. For GDPR, this may result in data breaches requiring notification under Article 33. For HIPAA, it could violate safeguards for protected health information, leading to compliance failures and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately enable SafeMode in fastjson 1.x via '-Dfastjson.parser.safeMode=true' or migrate to fastjson2. For Spring Boot apps, update to a patched version or disable AutoType. Avoid using SupportAutoType and restrict type resolution to strict allowlists.

Useful 0 Not Useful 0