CVE-2026-16723 is a remote code execution vulnerability in Fastjson 1.2.68 through 1.2.83, according to the Fastjson project’s own advisory. It applies only when the deployment and configuration conditions listed below all hold. The project names Fastjson 1.2.84 as the fixed release, dated July 29, 2026. The GitHub Advisory Database, however, lists “Patched versions: None” for the same CVE, and the NVD record could not be read for this article. Treat 1.2.84 as the project’s stated fix, confirm the version your build actually resolves, and carry the database discrepancy into any report you write.
Who is in scope
The maintainer advisory places the vulnerability in Fastjson 1.2.68 through 1.2.83. Within that range, the stated trigger requires all of the following:
As an Amazon Associate I earn from qualifying purchases.
- Packaging: a Spring Boot executable fat JAR. The advisory says deployments that are not fat JARs do not meet the stated trigger. That describes this CVE only. It is not a statement that other packaging formats are generally safe from deserialization bugs.
- SafeMode disabled: the stated trigger assumes SafeMode is off.
- Reachable parsing path: application code calls one of the entry points the advisory names,
JSON.parse,JSON.parseObject(String), orJSON.parseObject(String, Class), and attacker-influenced JSON can reach that call. - Version: Fastjson 1.2.68 through 1.2.83 inclusive. Older 1.x releases fall outside this advisory’s stated range. This article does not assess them, so check them against the project’s own advisories.
Why a target DTO class is not a mitigation
Calling JSON.parseObject(body, SomeDto.class) does not, according to the advisory, prevent exploitation. Payloads can be nested inside Object or Map fields of the DTO, so a reviewer who checks only the top-level type will miss them.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAutoType is not the dividing line
AutoType is the setting most Fastjson guidance discusses, which makes it the detail most likely to lead a team to a wrong conclusion. The project states that the issue is exploitable under the stock default configuration:
#1 Best Overall
“This vulnerability is exploitable under fastjson’s stock default configuration — no AutoType enablement required, no classpath gadget required.”
The question readers ask most often, whether Fastjson 1.2.83 is vulnerable with AutoType disabled, therefore has this answer: yes, if the packaging, SafeMode, and reachable-input conditions above also hold. Disabling AutoType does not substitute for any of the remediation routes below.
What the vulnerable code path does
According to the project advisory, Fastjson 1.x resolves type names taken from user-controlled JSON by probing for matching resources. The @JSONType annotation acts as a trust signal in that path. Because the attacker controls the type name, the attacker also influences what gets probed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The 1.2.84 change, per the advisory, rejects type names that contain URL-special characters such as : and ! before any resource probing or class loading takes place. The advisory also describes additional validation around whitelist matches and cached classes. The fix therefore sits inside the parser’s type-resolution step, which is why upgrading the library, rather than adjusting application code around it, is the change the project recommends.
Rank #2
Choosing a remediation route
The project’s preferred fix is an upgrade. The advisory lists the other routes as alternatives, and each carries its own caveats.
| Route | What the maintainer advisory states | Caveats before you rely on it |
|---|---|---|
| Upgrade to Fastjson 1.2.84 | Named as the fixed version. Versions 1.2.84 and later are listed as not affected by this path. The Fastjson repository release page dates 1.2.84 to July 29, 2026. | The GitHub Advisory Database lists “Patched versions: None” for this record. Confirm the artifact your repository actually resolves, and test the application before deployment. |
| Enable SafeMode | Listed as not affected by this path. Can be set with -Dfastjson.parser.safeMode=true, a setter on ParserConfig, or the fastjson.properties configuration. |
The advisory does not describe compatibility effects. Test every JSON contract the application depends on. |
| Use the noneautotype build | Listed as an alternative: com.alibaba:fastjson:1.2.83_noneautotype. |
The version string differs from the standard release, so pin it explicitly and confirm it resolves from a repository you trust. |
| Migrate to Fastjson2 | The project states that Fastjson2 is not affected by this CVE because the relevant resource-probing path is absent. | That statement covers this CVE only, not general security or compatibility. Migration is a code and dependency change, not a drop-in replacement. Run normal dependency review and migration tests. |
Checking your own exposure
-
Find every Fastjson artifact, including transitive ones. For Maven, run
mvn dependency:tree -Dincludes=com.alibaba:fastjson. For Gradle, run./gradlew dependencyInsight --dependency fastjson --configuration runtimeClasspath. Record the exact version and whether each hit is direct or transitive. Checkcom.alibaba:fastjson2separately, since it is a different artifact. -
Confirm the packaging. Spring Boot executable JARs keep their dependencies under
BOOT-INF/lib/. Runjar tf target/your-app.jar | grep "BOOT-INF/lib/fastjson"; Gradle projects write tobuild/libs/instead. A match shows the Fastjson JAR is bundled in an executable Spring Boot JAR, the packaging the advisory describes. The version appears in the JAR file name. A Fastjson2 match is a different artifact and should be assessed as such.The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check SafeMode. Inspect JVM start-up arguments for
-Dfastjson.parser.safeMode, anyfastjson.propertiesfile on the classpath, and code that calls theParserConfigsetter. If none of these sets SafeMode to true, SafeMode is not enabled through those routes, and the other conditions still need checking. -
Trace the input. List every endpoint, message consumer, and file reader that passes data into
JSON.parse,JSON.parseObject(String), orJSON.parseObject(String, Class). Mark any input an external party can shape, including fields that look internal, and note every DTO withObjectorMapfields. -
Verify after the change. Re-run the dependency command from step 1 against the built artifact, confirm the version in the JAR file name from step 2, and run integration tests on each JSON path identified in step 4.
Resolving the source conflict
Three sources report on the fix status, and they disagree:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The maintainer advisory, published on the Alibaba Fastjson2 repository wiki and last edited July 29, 2026, names 1.2.84 as the fix. The Alibaba Fastjson repository release page dates the 1.2.84 release to July 29, 2026.
- The GitHub Advisory Database record, published July 23, 2026 and updated August 7, 2026, lists “Patched versions: None”.
- The NVD record for CVE-2026-16723 could not be read for this article, so it cannot settle the disagreement.
Until the conflict is resolved, describe it as it stands: the project reports 1.2.84 as fixed, and the GitHub database lists no patched version for this entry. Do not describe the issue as definitively unpatched, and do not say that every database confirms 1.2.84 is fixed. For an operational decision, the question that matters is whether the artifact your build can actually resolve is 1.2.84 or later, and whether it passes your testing.
Rank #4
- Used Book in Good Condition
Severity and the pre-authentication label
The GitHub Advisory Database rates the record Critical with a CVSS v3 base score of 9.0 out of 10. Attribute that score to the GitHub Advisory Database, since the NVD record could not be checked for it. Its vector lists a network attack vector, high attack complexity, no privileges required, no user interaction, changed scope, and high impact to confidentiality, integrity, and availability.
The “no privileges required” and “no user interaction” elements are the basis for calling this flaw pre-authentication. An attacker does not need an account to reach the parsing path, provided the reachable-input condition above is met.
No source cited here gives a count of affected applications, deployments, or organizations, so the score should not be read as a measure of how widespread the exposure is. The project credits Kirill Firsov of FearsOff Cybersecurity with discovering and responsibly disclosing the flaw.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Active exploitation and vendor notices
Two secondary reports describe active exploitation: a Cloud Security Alliance AI Safety Initiative note dated July 27, 2026, and an F5 Labs threat bulletin dated July 29, 2026. Both were published in July 2026 and neither establishes exploitation status as of October 2026. Check current threat-intelligence reporting before stating that exploitation is ongoing.
Vendor notices point in the same direction, with product-specific differences:
- Tencent Cloud Security, July 23, 2026: recommends SafeMode, strict JSON schema validation or allowlisting before deserialization where appropriate, or replacing Fastjson. It states that removing third-party gadget classes is not sufficient for the vulnerability it describes.
- Huawei PSIRT, notice dated July 22–28, 2026: says an IPS signature database released after July 23, 2026 can detect and defend against network-layer attacks on specified Huawei firewall products. Coverage depends on product and configuration, so confirm it for your specific device model.
Network controls such as IPS signatures are defense in depth. They do not show that the Fastjson dependency has been fixed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
