Remote code execution in fastjson 1.2.68-1.2.83 (CVE-2026-16723)

A remote code execution vulnerability exists in fastjson 1.2.68 through 1.2.83, exploitable under the library's stock default configuration with no AutoType enablement and no classpath gadget required. The only deployment prerequisite is that the target application runs as a Spring Boot executable fat-jar launched via `java -jar`. The vulnerability is reachable through `JSON.parse`, `JSON.parseObject(String)`, and `JSON.parseObject(String, Class)`, and specifying a target class is not an effective mitigation. Public POC available. Affected versions: - fastjson 1.2.68 - 1.2.83 We recommend updating to: fastjson 1.2.84. CVSS 9.0 · our assessment: act_now Reference: https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 Details: https://vuln.today/cve/CVE-2026-16723