Fastjson 1.x Under Attack: CVE-2026-16723 Exploited, No Patch Yet for 1.x

Colleagues, I’d like to draw your attention to a cybersecurity incident.

Fastjson 1.x is now being actively targeted in real-world campaigns. The issue is CVE-2026-16723: in vulnerable Spring Boot applications, malicious JSON can lead to unauthenticated code execution.

What matters:
- there is no fixed version for Fastjson 1.x yet;
- for now, enable SafeMode or use fastjson:1.2.83_noneautotype;
- in the longer term, plan a migration to Fastjson2.

I would already check direct and transitive dependencies, as well as signs of compromise: @type, unusual outbound connections, and web shells.

Why this matters: the vulnerability affects application systems and can quickly escalate to RCE.

Have you already checked your projects for Fastjson 1.x?

#cybersecurity #vulnerability #RCE #Fastjson