CVE-2026-16723: fastjson has a remote code execution (RCE) vulnerability
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Published Jul 23, 2026 · Updated Aug 7, 2026
Affected packages
com.alibaba:fastjson
- Ecosystem
- Maven
- Affected
- >= 1.2.68, <= 1.2.83
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=com.alibaba:fastjson
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Credited to dor-hayun, AnvithaCDhanekula, timtebeek.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology