CVE-2026-16723: Remote Code Execution Vulnerability in fastjson
Summary
CVE-2026-16723: fastjson has a remote code execution (RCE) vulnerability. Affects com.alibaba:fastjson versions >= 1.2.68, <= 1.2.83. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fastjson is a widely used Java library for parsing and serializing JSON data. It is known for its high performance and ease of use, making it a popular choice among developers. However, certain versions of fastjson have been found to be vulnerable to a critical security issue that allows remote code execution, potentially compromising the integrity and security of applications that rely on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-16723 exists in fastjson versions 1.2.68 through 1.2.83. It allows an attacker to execute arbitrary code on the server without requiring AutoType enablement or a specific classpath gadget. This means that even applications using the default configuration of fastjson are at risk. The implications of this vulnerability are severe, as it can lead to unauthorized access, data breaches, and complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling features that may expose your application to this vulnerability. However, the best course of action is to apply the update as soon as possible.
Conclusion
The CVE-2026-16723 vulnerability in fastjson poses a significant risk to applications using affected versions. It is crucial for developers to update to version 1.2.84 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for com.alibaba:fastjson →
FAQ
CVE-2026-16723 is a critical remote code execution vulnerability found in fastjson versions 1.2.68 to 1.2.83.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your pom.xml file, you can determine if your application is affected by this vulnerability.
Failing to address this vulnerability can lead to unauthorized access, data breaches, and potential full system compromise.
While the best solution is to update to a patched version, you can temporarily disable features that may expose your application to this vulnerability.
The CVSS score for this vulnerability is 9.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.alibaba:fastjson.
