Critical Fastjson 1.x Vulnerability Under Active Exploitation With No Patch Available

A critical vulnerability in Fastjson, Alibaba's widely used JSON library for Java, is under active exploitation according to two separate security research firms, and no patched version of the affected 1.x branch currently exists.

Tracked as CVE-2026-16723, the flaw carries an Alibaba-assigned CVSS score of 9.0. In affected Spring Boot applications, a malicious JSON request can execute code without any authentication, running with the same privileges as the underlying Java process.

A narrow but common configuration is all it takes

The confirmed attack chain requires Fastjson versions 1.2.68 through 1.2.83, a Spring Boot executable fat-JAR deployment, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default setting. Notably, the vulnerability does not require AutoType to be enabled, and no classpath gadget chain is needed, both of which have historically been prerequisites for Fastjson exploitation in the past. That absence of prerequisites is precisely what makes this flaw more dangerous than earlier Fastjson vulnerabilities, since it removes two of the main configuration barriers organisations have previously relied on as informal mitigations.

The vulnerability was traced to Fastjson's type-resolution path. An attacker-controlled type value can be turned into a class-resource lookup, and in a compatible Spring Boot fat-JAR, a crafted nested JAR path can fetch attacker-controlled bytecode. A specific annotation in that resource can then be treated as a trust signal, allowing the malicious class to pass Fastjson's type checks and load successfully. The exploit chain has been independently verified across Spring Boot 2.x, 3.x, and 4.x running on JDK versions 8, 11, 17, and 21.

No fix exists yet for the affected branch

As of the most recent check, Alibaba has not released a patched Fastjson 1.x version. Organisations unable to migrate immediately are advised to enable SafeMode directly, or switch to a restricted build that disables AutoType entirely. Alibaba has listed migration to Fastjson2, a separate, unaffected codebase that does not use the same resource-probing or annotation-based trust path, as the long-term fix. The gap also raises a wider industry question about whether AI-assisted patching tools, such as Google's newly launched CodeMender agent, could eventually close windows like this faster than a maintainer's manual release cycle allows.

The exploit depends specifically on the Spring Boot executable fat-JAR loader. Plain non-fat JARs, generic uber-JARs, and applications deployed through Tomcat or Jetty as WAR files are not affected by this particular chain. Reachable entry points that expose the vulnerability include standard JSON parsing calls, and binding input to a fixed class is not sufficient protection when an object contains a generic field where the malicious payload can be nested.

Active exploitation confirmed, but with an unexplained gap in official tracking

One security research firm reported capturing in-the-wild exploitation attempts after adding detection support for the flaw, while a separate firm reported observing attack activity against financial services, healthcare, computing, retail, and other organisations, primarily concentrated in the United States, with smaller volumes observed in Singapore and Canada. Neither firm has published attack counts, raw request data, confirmed successful compromises, or named victims, meaning the current evidence establishes observed exploitation attempts rather than confirmed breaches. The pattern echoes a recent ransomware campaign that exploited an unauthenticated RCE flaw in Langflow, where attackers again needed no credentials and no unusual configuration to gain a foothold.

Curiously, an official government vulnerability assessment issued shortly after disclosure marked exploitation status as none, and the flaw remains absent from at least one major government-maintained catalogue of known exploited vulnerabilities as of the most recent check. The available public sources do not explain this mismatch between vendor-reported active exploitation and the more cautious official assessment, a discrepancy worth monitoring rather than resolving prematurely in either direction.

Why this matters for GCC enterprises running Java applications

Fastjson remains widely embedded in Java based enterprise applications across the region, often as a transitive dependency pulled in indirectly through other libraries rather than a component teams have deliberately chosen and are actively tracking. That indirect exposure is exactly what makes this vulnerability class dangerous in practice: an organisation can be running a vulnerable version of Fastjson without any engineering team member being aware it exists in their dependency tree at all. Regional threat actors have already shown a willingness to exploit exactly this kind of blind spot, as seen when MuddyWater targeted a Middle East airport and nine other global organisations through DLL side-loading, a technique that likewise relies on trusted software components behaving in ways defenders did not anticipate.

Security teams should treat this disclosure with urgency precisely because no patch currently exists for the 1.x branch. Organisations should inventory both direct and transitive Fastjson dependencies across their Java applications, apply the SafeMode configuration change immediately wherever full migration to Fastjson2 is not immediately feasible, and inspect affected systems for suspicious type values in JSON payloads, unexpected nested JAR references, unusual outbound connections, unexpected child processes, and unauthorised file changes that could indicate a webshell has already been deployed. Given that the confirmed attack chain requires no authentication and no unusual configuration beyond a default, disabled SafeMode setting, any internet-facing Spring Boot application using an affected Fastjson version should be treated as exposed until proven otherwise, not assessed as low risk by default.