Deserialization in Alibaba Fastjson
CVE-2026-16723
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.007, 52.0th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- Alibaba Fastjson — versions 1.2.68
Weakness classification (CWE)
Public exploits and proof-of-concept code
15 public repositories with exploit or proof-of-concept code for this CVE:
- dinosn/fastjson-jsontype-rce-lab (207 stars, last pushed 2026-07-27): Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType…
- learner330/fastjson-cve-2026-16723 (5 stars, last pushed 2026-08-12)
- why-success/fastjson-rce-lab (4 stars, last pushed 2026-07-28): Fastjson 1.2.83 RCE 靶场环境 (CVE-2026-16723)
- 1xPwn/CVE-2026-16723 (2 stars, last pushed 2026-09-30): A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.
- Nowafen/CVE-2026-16723 (2 stars, last pushed 2026-07-30)
- EQSTLab/CVE-2026-16723 (2 stars, last pushed 2026-07-30): Fastjson RCE
- Ethen1212/fastjson-CVE-2026-16723 (1 star, last pushed 2026-10-23): CVE-2026-16723 Fastjson 1.2.68-1.2.83 ???? RCE ?? (java.lang.Class whitelist bypass)
- yym8538/CVE-2026-16723 (1 star, last pushed 2026-08-21)
- Superman-L/CVE-2026-16723 (1 star, last pushed 2026-08-19): fastjson jsontype利用
- fazilbaig1/CVE-2026-16723 (1 star, last pushed 2026-07-31): This is N-day patch we releasing by testing our model capabilities
5 more are listed on the interactive page.
References
- github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-f… (vendor-advisory, mitigation)
This CVE has public exploit evidence. See the latest CVEs with public exploits.