{
  "id": 7888701,
  "title": "CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch",
  "url": "https://urgent.news/2026/09/16/cve-2026-16723-pre-auth-rce-in-fastjson-1-x-via-the-jsontype-trust",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T22:11:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/guidance_white/cve-2026-16723-pre-auth-rce-in-fastjson-1x-via-the-jsontype-trust-branch-10bf"
  },
  "original_language": "en",
  "account": "CVE-2026-16723 describes a pre-authentication remote code execution (RCE) vulnerability in the Fastjson 1.x library. This flaw allows an attacker to write and host a malicious class on a remote server and abuse Fastjson's class loading mechanism to execute arbitrary code.\n\nThe vulnerability is triggered when an attacker sends a specially crafted JSON payload to an endpoint that uses Fastjson's `JSON.parseObject()` method to parse the input. The JSON payload includes a JSON type annotation (@JSONType) pointing to the attacker's remote server along with a base64-encoded IP address.\n\nFastjson checks if the annotated class is safe by attempting to load the class bytes twice - first to inspect them and then to actually load them into memory. This process involves fetching the class bytes from the provided URL, which allows the attacker to control the source of the fetched data.\n\nThe attack chain consists of six deterministic steps:\n\n1. Building the malicious class annotated with @JSONType and containing a static block that executes `Runtime.exec()`.\n2. Hosting the malicious class on a remote HTTP server.\n3. Sending the crafted JSON payload to an endpoint using Fastjson's `JSON.parseObject()` method.\n4. Fastjson's `ParserConfig.checkAutoType()` method fetches the class bytes twice - once to inspect them and again to load them into memory.\n5. The static initializer of the malicious class runs automatically upon loading, executing the `Runtime.exec()` command and allowing the attacker to execute arbitrary code on the target system.\n6. No patches or mitigations exist for this vulnerability, as the vendor has declared Fastjson 1.x End of Life (EOL) and recommends users to migrate to Fastjson 2.",
  "summary": "Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JAR, safeMode disabled (default), AutoType disabled (default) Auth required None (pre-authentication) CVSS 9.0 (9.8 under some scoring authorities) Patch None — Alibaba has declared Fastjson 1.x EOL and points users to Fastjson2 What makes this one…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}