No autoType, No Gadget, Still RCE: Inside the fastjson 1.x Zero-Day (CVE-2026-16723)

A single crafted JSON request can hand an attacker remote code execution on a default-configured Spring Boot app that ships fastjson 1.2.68 through 1.2.83 - Alibaba's ubiquitous Java JSON library. What makes CVE-2026-16723 stand out from the library's long history of deserialization bugs is what it doesn't need: no autoType toggle, no classpath gadget, no special configuration. It works out of the box, it is rated CVSS 9.0 (Critical), and it is already being exploited in the wild.

What is actually broken

When fastjson deserializes JSON, a special @type key tells it which Java class to build. To resolve that class name, fastjson 1.x's checkAutoType routine probes the attacker-controlled name with getResourceAsStream - and it does this before the autoType safety checks fully apply. In a Spring Boot executable fat-jar (the standard packaging, where dependencies live in nested BOOT-INF/lib/*.jar behind a custom jar: URL handler), an attacker points that lookup at a nested-JAR URL they control. A @JSONType annotation is mistakenly treated as a trust signal, letting the supplied class skip the dangerous-class checks entirely.

The practical chain: the attacker's JSON references a remote jar:http://... URL, which fastjson fetches and caches; a follow-up probe using jar:file:/proc/self/fd/N reopens that cached archive under a valid class name and initializes the attacker's class - running code even with autoType off. On JDK 8 the remote class loads directly; on JDK 17/21 the Linux /proc/self/fd file-descriptor trick is used instead. Because the primitive is remote class loading over jar: URLs and not a JNDI lookup, the well-known post-JDK-8u191 JNDI hardening (trustURLCodebase=false) does nothing to stop it. The weakness is classic CWE-502, deserialization of untrusted data.

The exploitation chain

Reading top to bottom: an unauthenticated attacker finds an endpoint that parses untrusted JSON, confirms the vulnerable preconditions, then walks a crafted @type payload through fastjson's resource-probing path to code execution. The only branch that avoids it is having safeMode on, or running a fixed build.

Am I affected?

Exposure needs several conditions together. Work down this list - if all hold, treat it as an emergency.

unzip -p app.jar META-INF/maven/com.alibaba/fastjson/pom.properties# -> version=1.2.83   (affected: 1.2.68 - 1.2.83)# Relocated/shaded copies - grep the class signature:unzip -l app.jar | grep -i 'com/alibaba/fastjson/parser/ParserConfig.class'# Safe exposure probe (benign class, DNS callback only - NO payload):#   {"x":{"@type":"java.net.Inet4Address","val":"probe.yourdnslog.example"}}# A DNS hit at your logger = the endpoint parses @type and can reach out.

Is anyone actually exploiting it?

Yes. ThreatBook added detection on 20 Jul 2026 and reported capturing exploitation in the wild; Imperva independently observed attacks against live customers, describing activity as widespread and opportunistic - multiple likely-unrelated actors firing public proof-of-concept code, almost entirely at US-based organizations (with a few in Singapore and Canada) across financial services, healthcare, retail and computing. Roughly 30% of the exploit traffic came from Ruby- and Go-based tooling, the rest from browser-impersonating scanners. Detection and exploitation landed at or before public disclosure, so this behaves as a zero-day.

Fix it: what to do today

There is a real fix now (1.2.84, listed in the 29 Jul advisory update - early coverage saying "no 1.x patch exists" is stale), plus a same-day compensating control. Prioritize internet-facing JSON endpoints first.

1. Today - enable safeMode. Set -Dfastjson.parser.safeMode=true (or ParserConfig.getGlobalInstance().setSafeMode(true);, or fastjson.parser.safeMode=true in fastjson.properties). It fully disables @type parsing and neutralizes the vector.
2. Patch. Upgrade to fastjson 1.2.84, or use the hardened com.alibaba:fastjson:1.2.83_noneautotype build if you cannot bump the minor.
3. Plan the durable move. Migrate to fastjson2 (2.0.63+), which is allowlist-first with autoType off by default; do not enable SupportAutoType.
4. Compensating controls, in parallel. WAF-block request bodies where a JSON @type value carries jar:http, jar:file, ldap: or rmi:; deny outbound LDAP (389) / LDAPS (636) / RMI (1099) egress from app subnets, and constrain outbound HTTP that would fetch a remote jar:http payload.
5. Hunt. Search WAF and app logs for @type requests carrying jar:http / jar:file (rules below) to catch any pre-mitigation compromise.

title: Fastjson autoType/@type Deserialization RCE Attempt (CVE-2026-16723)
status: experimental
logsource:
  category: webserver
detection:
  atype_marker:
    cs-body|contains: '@type'
  cve16723_markers:
    cs-body|contains:
      - 'jar:http'
      - 'jar:file'
  jndi_callback:
    cs-body|contains: ['ldap://', 'ldaps://', 'rmi://']
  gadget_classes:
    cs-body|contains:
      - 'com.sun.rowset.JdbcRowSetImpl'
      - 'com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl'
      - 'org.apache.tomcat.dbcp.dbcp2.BasicDataSource'
      - '_bytecodes'
      - 'dataSourceName'
  condition: atype_marker and (cve16723_markers or jndi_callback or gadget_classes)
falsepositives:
  - Apps that legitimately use fastjson polymorphic @type with a trusted allowlist
  - The java.net.Inet4Address dnslog exposure probe
level: high
tags: [attack.initial_access, attack.t1190, attack.execution, cve.2026.16723]

alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"FASTJSON RCE nested jar URL in @type body (CVE-2026-16723)"; flow:established,to_server; content:"@type"; nocase; pcre:"/jar\x3a(https?|file)\x3a/i"; classtype:attempted-admin; reference:cve,2026-16723; sid:2026167233; rev:1;)
alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"FASTJSON RCE JNDI callback URL in @type body"; flow:established,to_server; content:"@type"; nocase; pcre:"/(ldaps?|rmi)\x3a\x2f\x2f/i"; classtype:attempted-admin; reference:cve,2026-16723; sid:2026167234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [389,636,1099] (msg:"FASTJSON RCE possible JNDI/RMI second-stage egress"; flow:established,to_server; classtype:bad-unknown; reference:cve,2026-16723; sid:2026167235; rev:1;)

rule Fastjson_AutoType_RCE_CVE_2026_16723 {
  meta:
    description = "Fastjson @type deserialization RCE markers (CVE-2026-16723 + classic chains)"
    cve = "CVE-2026-16723"
  strings:
    $atype = "@type" ascii wide
    $g1 = "com.sun.rowset.JdbcRowSetImpl" ascii wide
    $g2 = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl" ascii wide
    $g3 = "org.apache.tomcat.dbcp.dbcp2.BasicDataSource" ascii wide
    $p1 = "dataSourceName" ascii wide
    $p2 = "_bytecodes" ascii wide
    $u1 = "jar:http" ascii wide
    $u2 = "jar:file" ascii wide
    $u3 = "ldap://" ascii wide
    $u4 = "rmi://" ascii wide
  condition:
    $atype and ( any of ($g*) or any of ($u1,$u2) or (any of ($p*) and any of ($u*)) )
}

Sources

• Alibaba fastjson security advisory - RCE in fastjson 1.2.68-1.2.83
• NVD - CVE-2026-16723
• Imperva - customers protected against CVE-2026-16723
• ThreatBook - fastjson RCE 1.2.83 active exploitation detected
• BleepingComputer - hackers target US firms in fastjson RCE zero-day attacks
• The Hacker News - fastjson 1.x RCE targeted in attacks
• SecurityWeek - unpatched fastjson vulnerability exploited in attacks
• fastjson SafeMode documentation
• FIRST - EPSS for CVE-2026-16723