CVE-2026-16723 Overview
CVE-2026-16723 is a remote code execution (RCE) vulnerability in Alibaba fastjson versions 1.2.68 through 1.2.83. The flaw is exploitable under the stock default configuration of the library. Attackers do not need AutoType enabled and do not require a classpath gadget to trigger code execution. The issue is tracked as an improper input validation weakness [CWE-20] affecting the JSON parsing path.
Applications that deserialize untrusted JSON with a vulnerable fastjson release expose network-reachable endpoints to arbitrary code execution. The condition affects confidentiality, integrity, and availability of the host process running the parser.
Critical Impact
Remote attackers can achieve code execution on servers processing attacker-controlled JSON without any non-default fastjson configuration.
Affected Products
- Alibaba fastjson version 1.2.68
- Alibaba fastjson versions 1.2.69 through 1.2.82
- Alibaba fastjson version 1.2.83
Discovery Timeline
- 2026-07-23 - CVE-2026-16723 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-16723
Vulnerability Analysis
The vulnerability resides in the fastjson 1.x deserialization pipeline. fastjson parses JSON input and instantiates Java objects based on structural cues in the payload. Prior fixes hardened the AutoType mechanism and introduced a safeMode and denylist of known gadget classes.
This flaw bypasses those mitigations. The parser reaches an unsafe object instantiation path even when AutoType remains disabled, which was previously considered a safe posture. The referenced GitHub advisory confirms the condition affects stock default settings across releases 1.2.68 to 1.2.83.
Exploitation results in arbitrary Java code execution within the JVM process. Attack complexity is elevated because the trigger depends on specific parser state, but no authentication or user interaction is required.
Root Cause
The root cause is improper input validation [CWE-20] during JSON-to-object conversion. fastjson fails to enforce class instantiation restrictions on a parsing branch that operates independently of the AutoType gate. The parser trusts structural fields in the payload to select and initialize object types.
Attack Vector
An attacker submits a crafted JSON document to any endpoint that passes untrusted input to JSON.parse, JSON.parseObject, or equivalent APIs. The payload steers the parser into the unsafe instantiation branch. Because no classpath gadget is required, exploitation does not depend on the presence of vulnerable libraries such as commons-collections or JNDI providers.
Refer to the GitHub Security Advisory for the technical write-up and payload structure.
Detection Methods for CVE-2026-16723
Indicators of Compromise
- Unexpected child processes spawned by Java application servers such as java, tomcat, or Spring Boot fat JARs immediately after HTTP requests carrying JSON bodies.
- Outbound network connections from JVM processes to attacker infrastructure following inbound application/json POST requests.
- Application logs containing fastjson parser exceptions or class instantiation errors near the time of suspicious activity.
Detection Strategies
- Inventory Java dependencies and flag any artifact matching com.alibaba:fastjson:1.2.68 through 1.2.83. Software composition analysis tools and mvn dependency:tree reliably surface transitive inclusions.
- Inspect HTTP request bodies at the web application firewall for JSON payloads containing suspicious type hints or nested object structures targeting deserialization sinks.
- Correlate JVM process behavior with request telemetry. Endpoint telemetry that shows a Java process executing shell binaries after JSON ingestion is a high-fidelity signal.
Monitoring Recommendations
- Enable audit logging on all endpoints that accept JSON from untrusted sources and forward logs to a centralized SIEM.
- Alert on Java processes invoking Runtime.exec, ProcessBuilder, or child processes such as sh, bash, cmd.exe, or powershell.exe.
- Monitor egress traffic from application servers for connections to non-approved hosts, particularly LDAP, RMI, or raw TCP callbacks.
How to Mitigate CVE-2026-16723
Immediate Actions Required
- Upgrade fastjson to a fixed release or migrate to fastjson2, which the vendor recommends as the supported successor.
- Identify all applications embedding fastjson1.2.68 through 1.2.83, including transitive dependencies pulled through frameworks and internal libraries.
- Restrict inbound access to services that deserialize JSON from untrusted clients until patches are validated in production.
Patch Information
Alibaba published fix guidance in the GitHub Security Advisory. Consult the advisory for the exact fixed version and migration steps to fastjson2.
Workarounds
- Place JSON-accepting endpoints behind a web application firewall with rules that reject payloads containing type-hint keys such as @type or deeply nested object structures targeting deserialization.
- Apply JVM-level allowlists using a Java Security Manager or a custom ObjectInputFilter where feasible to constrain class instantiation.
- Isolate JVM workloads using least-privilege service accounts and container-level egress controls to limit blast radius if exploitation occurs.
# Identify vulnerable fastjson artifacts in a Maven project
mvn dependency:tree -Dincludes=com.alibaba:fastjson | grep -E "1\.2\.(6[89]|7[0-9]|8[0-3])"
# Identify fastjson JARs deployed on a host
find / -name "fastjson-1.2.*.jar" 2>/dev/null
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
