--- title: Fastjson 1.2.x RCE vulnerability: what it is, how it... description: A critical RCE vulnerability (CVSS 9.8, CVE-2026-16723) has been disclosed in Fastjson 1.2.68–1.2.83 with confirmed active exploitation. Unlike previous... canonical: https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fastjson 1.2.x RCE vulnerability: what it is, how it works, and how to mitigate it | daily.dev og:description: A critical RCE vulnerability (CVSS 9.8, CVE-2026-16723) has been disclosed in Fastjson 1.2.68–1.2.83 with confirmed active exploitation. Unlike previous... og:url: https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9 og:image: https://api.daily.dev/og/posts/6xgg5pLa9.png og:image:alt: Fastjson 1.2.x RCE vulnerability: what it is, how it works, and how to mitigate it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fastjson 1.2.x RCE vulnerability: what it is, how it works, and how to mitigate it **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary A critical RCE vulnerability (CVSS 9.8, CVE-2026-16723) has been disclosed in Fastjson 1.2.68–1.2.83 with confirmed active exploitation. Unlike previous Fastjson exploits, this one requires no gadget classes — it abuses the @type field combined with @JSONType annotations to trigger a class-resource lookup inside Spring Boot fat-JARs, bypassing both the autoType blacklist and whitelist. No official patch exists for the 1.x branch. Immediate mitigation is to enable SafeMode via JVM flag (-Dfastjson.parser.safeMode=true), with a longer-term migration to Fastjson 2.x recommended. WAF rules blocking @type in JSON bodies provide an additional but bypassable layer of defense. ## Content A critical remote code execution vulnerability in Alibaba's FastJson Java library is being actively exploited against US organizations. There's no patch, and FastJson 1.x is no longer actively maintained — so if you're running it, you need to act now. ## What's affected FastJson versions 1.2.68 through 1.2.83 are vulnerable. The flaw carries a CVSS score of 9.8 and requires no authentication, no user interaction, and no elevated privileges to exploit. Confirmed targets include organizations in financial services, healthcare, and retail, though any internet-facing service deserving FastJson is at risk. Internal services are too, if an attacker already has any foothold. FastJson 2.x is not affected. ## How it works FastJson's deserialization logic accepts a `@type` field that tells the library which Java class to instantiate. The vulnerability abuses this alongside a `@JSONType` annotation to trigger a class-resource lookup inside nested JAR structures — specifically the kind produced by Spring Boot fat-JAR deployments. The critical detail: this happens *before* AutoType restrictions are enforced. That means the blacklist/whitelist protection FastJson relies on doesn't get a chance to block it. Attackers don't need any third-party gadget classes on the classpath either, which is what makes this harder to dismiss than previous FastJson issues. Proof-of-concept code is public, and active exploitation has been confirmed by ThreatBook and Imperva. ## What to do right now **Enable SafeMode.** This is the fastest mitigation. You can do it three ways: - JVM flag: `-Dfastjson.parser.safeMode=true` - In code: call `ParserConfig.getGlobalInstance().setSafeMode(true)` at startup - Via `fastjson.properties` configuration file SafeMode disables `@type` processing entirely. It may break functionality if your application relies on polymorphic deserialization, so test before deploying to production. Alternatively, switch to the `noneautotype` build of FastJson 1.x, which removes AutoType support at the library level. **Add WAF rules** to block requests containing the `@type` field as a short-term layer of defense. **Check your logs** for unexpected `@type` payloads in JSON request bodies — that's the clearest indicator of active probing or exploitation attempts. ## Finding out if you're exposed Run `mvn dependency:tree | grep fastjson` to catch transitive dependencies pulling in a vulnerable version. A lot of teams get caught by this — FastJson shows up as a transitive dependency in frameworks and internal libraries, not just direct dependencies. ## Longer term: migrate to FastJson 2 FastJson 1.x has no official patch coming. The library uses a blocklist-first model that has been bypassed repeatedly over the years. FastJson 2 was rewritten with an allowlist-first approach and is not affected by this vulnerability. Migration isn't trivial — the API has changed — but it should be treated as planned work, not optional. Running an unmaintained library with a public exploit and active exploitation in the wild is not a sustainable position. ## Questions this post answers ### Which versions of FastJson are vulnerable to the actively exploited RCE bug? FastJson versions 1.2.68 through 1.2.83 are vulnerable to a critical remote code execution flaw with a CVSS score of 9.8, exploitable without authentication, user interaction, or elevated privileges. The bug abuses the @type deserialization field with a @JSONType annotation to reach class-resource lookups inside Spring Boot fat-JAR structures before AutoType restrictions apply. FastJson 2.x is not affected. _Teams auditing dependency trees for FastJson exposure can track vulnerability news like this on daily.dev._ ### How do I mitigate the FastJson AutoType RCE vulnerability without a patch available? Enable SafeMode immediately, either with the JVM flag -Dfastjson.parser.safeMode=true, by calling ParserConfig.getGlobalInstance().setSafeMode(true) at startup, or via fastjson.properties. SafeMode disables @type processing entirely, so test first since it can break polymorphic deserialization. Alternatively, switch to the noneautotype build, add WAF rules blocking @type in requests, and check logs for suspicious @type payloads. _Developers deciding on a mitigation path for FastJson can follow security fixes and patch guidance on daily.dev._ ### How do I check if my Java project has a vulnerable transitive dependency on FastJson? Run mvn dependency:tree | grep fastjson to surface transitive dependencies pulling in a vulnerable FastJson version, since it commonly appears indirectly through frameworks and internal libraries rather than as a direct dependency. Confirming exposure this way is important because internal services can also be at risk if an attacker already has any foothold in the network. _Java engineers auditing dependency chains for hidden vulnerabilities often keep up with advisories via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 1 upvotes > The transitive dependency angle is the scary bit—teams may be exposed without knowing they use Fastjson directly. SafeMode now, dependency-tree check today, migration next. No time to kick the can down the road. ## Similar posts on daily.dev - [Fastjson 2.x Remote Code Execution Vulnerability Notice](https://daily.dev/posts/fastjson-2-x-remote-code-execution-vulnerability-notice-qj1f3nati) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot) [View this post on daily.dev](https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fastjson 1.2.x RCE vulnerability: what it is, how it works, and how to mitigate it","url":"https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9"},"datePublished":"2026-07-26T19:13:19.766Z","dateModified":"2026-09-13T19:40:27.010Z","description":"A critical RCE vulnerability (CVSS 9.8, CVE-2026-16723) has been disclosed in Fastjson 1.2.68–1.2.83 with confirmed active exploitation. Unlike previous...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2851b58660e2c93a0106bfeae9c27823?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2851b58660e2c93a0106bfeae9c27823?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"java,spring-boot","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Fastjson 1.2.x RCE vulnerability: what it is, how it works, and how to mitigate it"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9","comment":[{"@type":"Comment","text":"The transitive dependency angle is the scary bit—teams may be exposed without knowing they use Fastjson directly. SafeMode now, dependency-tree check today, migration next. No time to kick the can down the road.","datePublished":"2026-07-27T01:41:17.780Z","url":"https://daily.dev/posts/6xgg5pLa9#c-zO3Inswvb","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fastjson-1-2-x-rce-vulnerability-what-it-is-how-it-works-and-how-to-mitigate-it-6xgg5pla9#faq","mainEntity":[{"@type":"Question","name":"Which versions of FastJson are vulnerable to the actively exploited RCE bug?","acceptedAnswer":{"@type":"Answer","text":"FastJson versions 1.2.68 through 1.2.83 are vulnerable to a critical remote code execution flaw with a CVSS score of 9.8, exploitable without authentication, user interaction, or elevated privileges. The bug abuses the @type deserialization field with a @JSONType annotation to reach class-resource lookups inside Spring Boot fat-JAR structures before AutoType restrictions apply. FastJson 2.x is not affected. Teams auditing dependency trees for FastJson exposure can track vulnerability news like this on daily.dev."}},{"@type":"Question","name":"How do I mitigate the FastJson AutoType RCE vulnerability without a patch available?","acceptedAnswer":{"@type":"Answer","text":"Enable SafeMode immediately, either with the JVM flag -Dfastjson.parser.safeMode=true, by calling ParserConfig.getGlobalInstance().setSafeMode(true) at startup, or via fastjson.properties. SafeMode disables @type processing entirely, so test first since it can break polymorphic deserialization. Alternatively, switch to the noneautotype build, add WAF rules blocking @type in requests, and check logs for suspicious @type payloads. Developers deciding on a mitigation path for FastJson can follow security fixes and patch guidance on daily.dev."}},{"@type":"Question","name":"How do I check if my Java project has a vulnerable transitive dependency on FastJson?","acceptedAnswer":{"@type":"Answer","text":"Run mvn dependency:tree | grep fastjson to surface transitive dependencies pulling in a vulnerable FastJson version, since it commonly appears indirectly through frameworks and internal libraries rather than as a direct dependency. Confirming exposure this way is important because internal services can also be at risk if an attacker already has any foothold in the network. Java engineers auditing dependency chains for hidden vulnerabilities often keep up with advisories via daily.dev."}}]} ```