Unpatched Fastjson flaw lets a single JSON request run code on Spring Boot apps

Security firms ThreatBook and Imperva report attackers targeting a critical flaw in Fastjson, Alibaba's widely used JSON library for Java. On affected Spring Boot applications, a malicious JSON request can execute code without authentication, running with the privileges of the Java process. Tracked as CVE-2026-16723 with an Alibaba-assigned score of 9.0, the confirmed chain needs Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that feeds attacker-controlled JSON to the parser, and SafeMode left at its disabled default. Notably, the AutoType feature can stay off and no classpath gadget is required. As of July 25, Alibaba had not shipped a fixed 1.x version.

Check

Inventory Java services for Fastjson 1.x on the classpath, identify any endpoint that parses untrusted JSON, and enable SafeMode now rather than waiting for a fixed release.

Affected

Spring Boot applications packaged as fat-JARs using Fastjson 1.2.68 through 1.2.83 with SafeMode disabled (CVE-2026-16723); an unauthenticated JSON request reaches code execution, and no fixed 1.x version exists yet.

Fix

Enable SafeMode by setting fastjson.parser.safeMode to true, or switch to the noneautotype build, restrict network paths that parse untrusted JSON, and plan migration off Fastjson 1.x.