ThreatBook captured in‑the‑wild exploitation on July 22, proving that the Fastjson RCE vulnerability isn’t just theory. The flaw lets a malicious JSON payload run code on any Spring Boot executable fat‑JAR that leaves SafeMode disabled. That’s the catch.
Key Takeaways
- Fastjson versions 1.2.68‑1.2.83 are vulnerable to unauthenticated RCE in Spring Boot fat‑JARs.
- Alibaba hasn’t released a patched 1.x version as of July 25, 2026.
- Enabling SafeMode (‑Dfastjson.parser.safeMode=true) or using the 1.2.83_noneautotype build can mitigate the risk.
- ThreatBook and Imperva report active exploitation targeting finance, healthcare, and retail sectors.
- Fastjson2 isn’t affected because it uses a different parsing model.
Historical Context
Fastjson debuted as Alibaba’s open‑source JSON processor, quickly becoming a default choice for Java micro‑services because of its speed and ease of use. Early adoption spread across fintech, e‑commerce, and cloud‑native workloads. The library’s simplicity, however, also attracted scrutiny from security researchers.
In 2022, a separate AutoType bypass surfaced, showing that Fastjson’s automatic class‑resolution could be abused when certain configuration flags were left on. That incident forced many teams to disable AutoType across the board, a step that later proved insufficient for the July 2026 chain.
Fastjson2 arrived as a rewrite that abandons the vulnerable resource‑probing path. Its different parsing model means the same payload cannot trigger class loading, which is why the current advisory explicitly marks Fastjson2 as safe.
Despite the newer version, a large number of legacy services still run Fastjson 1.x. Those services often ship as Spring Boot executable fat‑JARs, a packaging style that bundles the application, its dependencies, and an embedded servlet container into a single archive. That convenience also creates a single attack surface when the parser is misconfigured.
Fastjson RCE vulnerability: Why Spring Boot fat‑JARs are under fire
When Alibaba assigned a CVSS score of 9.0 to CVE‑2026‑16723, it signaled a severe risk. The chain requires Fastjson 1.2.68 through 1.2.83, a Spring Boot executable fat‑JAR, a network‑reachable endpoint, and SafeMode left at its disabled default. No AutoType enablement or classpath gadget is needed, which makes the exploit unusually clean.
Technical chain explained
Kirill Firsov of FearsOff Cybersecurity discovered that an attacker‑controlled @type value can be turned into a class‑resource lookup. In a compatible Spring Boot fat‑JAR, a crafted nested JAR path fetches attacker‑controlled bytecode. An @JSONType annotation in that resource then acts as a trust signal, allowing the class to pass Fastjson’s type checks and load.
Firsov also identified a newer‑JDK path that downloads a remote JAR and references it through /proc/self/fd. That means even on JDK 17 or 21, the exploit can pull in external code without any local JAR present.
The payload starts with a JSON object that includes a malicious @type. Fastjson reads that field, treats it as a class name, and delegates loading to the underlying classloader. Spring Boot’s fat‑JAR loader interprets the nested JAR URL, opens a stream to the attacker‑hosted artifact, and hands the bytecode back to the VM. Because SafeMode is off, Fastjson does not reject the unknown type, and the class is instantiated.
When the remote JAR is fetched via /proc/self/fd, the operating system provides a file descriptor that points at the downloaded content. The descriptor is then used as a path element, bypassing the usual JAR‑file verification steps. This technique works across JDK versions, keeping the attack viable for years to come.
What makes the chain possible?
- Fastjson’s type‑resolution path trusts
@typevalues. - Spring Boot’s fat‑JAR loader can resolve nested JAR URLs.
- SafeMode defaults to disabled, so the parser doesn’t reject unknown types.
- AutoType can stay disabled, removing a common mitigation step.
Because the exploit doesn’t rely on a classpath gadget, defenders can’t simply block known gadget chains. Instead they must stop the parser from loading arbitrary classes in the first place.
Who’s seeing the attacks and how they’re carried out
Imperva logged activity across financial services, healthcare, computing, and retail organizations, primarily in the United States, with smaller volumes in Singapore and Canada. The firm said browser impersonators generated most requests, while Ruby and Go tools made up about 30 % collectively.
Neither ThreatBook nor Imperva published raw request logs, attack counts, or named victims. Their reports show observed exploit activity, not confirmed breaches. That distinction matters because a successful exploit in a lab doesn’t always translate to a real‑world compromise.
ThreatBook’s platform started detecting the exploit two days after adding support, and it reproduced full code execution on a Spring Boot fat‑JAR running JDK 8. Its embedded Tomcat test, however, only fetched a remote JAR or caused a server‑side request forgery.
Patch status and mitigation steps
Alibaba published an advisory on July 21 after a responsible disclosure by Kirill Firsov. The maintainers emphasized that the chain requires “no AutoType enablement” and “no classpath gadget.” They verified the exploit on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21.
“no AutoType enablement” and “no classpath gadget”
As of July 25, Alibaba hadn’t released a patched Fastjson 1.x version. The latest standard 1.x release, 1.2.83, sits inside the vulnerable range. Alibaba does offer a restricted build—1.2.83_noneautotype—that disables AutoType, but SafeMode still needs to be enabled manually.
Recommended mitigations are:
- Run the JVM with -Dfastjson.parser.safeMode=true to enable SafeMode.
- Swap to the com.alibaba:fastjson:1.2.83_noneautotype artifact.
- Inventory direct and transitive Fastjson dependencies and audit them for suspicious
@typevalues. - Consider migrating to Fastjson2, which isn’t vulnerable because it doesn’t use the same resource‑probing path.
Non‑fat JARs, generic uber‑JARs, and Tomcat or Jetty WAR deployments are listed as unaffected, which narrows the attack surface to Spring Boot’s executable packaging.
What defenders can do now
Security teams should scan their codebases for any use of Fastjson 1.x, especially in Spring Boot services that produce executable fat‑JARs. Look for JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class) entry points. If you spot a field typed as Object or Map, treat it as a potential nesting spot for the payload.
Monitoring for unexpected outbound connections, new child processes, file modifications, or web shells can help spot post‑exploitation activity. Because the exploit can download a remote JAR, network egress to unknown hosts is a red flag.
What This Means For You
If you’re shipping Spring Boot services as fat‑JARs, you’ve got a ticking time bomb. Enable SafeMode today, even if you think you’ve disabled AutoType. That single JVM flag can block the most common exploit path.
For teams unable to patch immediately, move to the 1.2.83_noneautotype build and start planning a migration to Fastjson2. The longer you stay on an unpatched 1.x version, the more likely you’ll see an attacker try to weaponize the flaw.
And if you’re a developer who’s never touched Fastjson directly, you should still inventory your transitive dependencies. Many third‑party libraries pull Fastjson in without you noticing.
Fastjson’s track record of critical vulnerabilities—this one and the AutoType bypass disclosed in 2022—makes it a high‑risk component. Ignoring the issue isn’t an option.
Will Alibaba finally push a patched 1.x release, or will the community be forced to abandon Fastjson altogether? Only.
Competitive Landscape
Java ecosystems host several alternative JSON parsers. Jackson, for instance, has long been the de‑facto standard for many enterprises. GSON offers a lightweight option favored by Android developers. Those libraries employ different type‑resolution strategies, which means the specific Fastjson chain does not apply to them.
Choosing an alternative can reduce exposure, but migration costs must be weighed. Projects that already rely heavily on Fastjson’s annotations may need to refactor serialization code. Still, moving away from a library with a history of critical bugs can simplify compliance audits.
Some organizations adopt a hybrid approach: keep Fastjson for legacy modules while using a newer parser for new services. This reduces the blast radius of a single vulnerability and allows incremental upgrades.
Concrete Scenarios for Developers and Founders
Fintech startup: Your payment gateway runs a Spring Boot service packaged as a fat‑JAR. An attacker sends a malicious JSON payload to a public endpoint that parses incoming webhook data. With SafeMode off, the payload triggers remote code execution, potentially stealing transaction keys. Enabling SafeMode and swapping to the noneautotype build would stop the chain before it reaches the JVM.
Healthcare provider: An internal analytics pipeline consumes patient records via Fastjson. The pipeline is deployed behind a VPN, yet a compromised workstation can still reach the service. By auditing the dependency tree and applying the SafeMode flag, you block any rogue @type injection, preserving patient confidentiality.
Retail e‑commerce platform: Your catalog service aggregates product feeds from multiple vendors. One feed contains a malformed JSON object that includes an @type field. Because the service runs as a fat‑JAR, the malicious object could load a remote JAR and install a backdoor. Switching to Fastjson2 for new micro‑services eliminates the attack vector while the existing services are hardened with SafeMode.
In each case, the mitigation steps are the same: enable SafeMode, consider the noneautotype artifact, and review any transitive Fastjson usage. The payoff is immediate risk reduction without a full rewrite.
Key Questions Remaining
- Will Alibaba issue a patched 1.x release before attackers automate the exploit at scale?
- How many production Spring Boot fat‑JARs remain on vulnerable Fastjson versions after the advisory?
- Can the community develop a reliable detection rule that flags the specific @type pattern without generating false positives?
- What impact will a widespread migration to Fastjson2 have on existing codebases that rely on Fastjson‑specific features?
Answers to these questions will shape the next wave of defensive tooling and influence long‑term library choices.
Sources: The Hacker News, Imperva
