CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

CVE-2026-16723 describes a pre-authentication remote code execution (RCE) vulnerability in the Fastjson 1.x library. This flaw allows an attacker to write and host a malicious class on a remote server and abuse Fastjson's class loading mechanism to execute arbitrary code.

The vulnerability is triggered when an attacker sends a specially crafted JSON payload to an endpoint that uses Fastjson's `JSON.parseObject()` method to parse the input. The JSON payload includes a JSON type annotation (@JSONType) pointing to the attacker's remote server along with a base64-encoded IP address.

Fastjson checks if the annotated class is safe by attempting to load the class bytes twice - first to inspect them and then to actually load them into memory. This process involves fetching the class bytes from the provided URL, which allows the attacker to control the source of the fetched data.

The attack chain consists of six deterministic steps:

1. Building the malicious class annotated with @JSONType and containing a static block that executes `Runtime.exec()`.

2. Hosting the malicious class on a remote HTTP server.

3. Sending the crafted JSON payload to an endpoint using Fastjson's `JSON.parseObject()` method.

4. Fastjson's `ParserConfig.checkAutoType()` method fetches the class bytes twice - once to inspect them and again to load them into memory.

5. The static initializer of the malicious class runs automatically upon loading, executing the `Runtime.exec()` command and allowing the attacker to execute arbitrary code on the target system.

6. No patches or mitigations exist for this vulnerability, as the vendor has declared Fastjson 1.x End of Life (EOL) and recommends users to migrate to Fastjson 2.