Fastjson RCE: Spring Boot Dependency Check for SMBs

CVE-2026-16723 affects Alibaba Fastjson 1.x versions 1.2.68 through 1.2.83 when applications use the affected default behavior. Alibaba says SafeMode and the noneautotype build are not affected, and Fastjson2 is not affected by this CVE. That does not establish that every Fastjson2 release is free of every security issue.

Find the dependency accurately

• Inspect Maven and Gradle dependency trees and lock files.
• Scan built JARs, fat JARs, containers, and deployed artifacts.
• Record the resolved version, not only the declared top-level dependency.
• Identify code paths accepting untrusted JSON and the configuration used.
• Check vendor applications that may embed the library.

Interpret affected conditions

The vendor’s published range is 1.2.68 through 1.2.83. SafeMode and noneautotype are not affected by this issue. Exposure still depends on the application path and input. Do not treat a package-name match alone as proof of successful exploitation.

Remediate and test

1. Create a reproducible dependency inventory.
2. Upgrade or migrate according to Alibaba’s guidance.
3. Rebuild the complete artifact and rescan it.
4. Run application, serialization, integration, and security tests.
5. Deploy through normal change control with rollback.
6. Verify the deployed artifact no longer contains the affected version.

Investigate reported exploitation carefully

If named security vendors report exploitation, cite the vendor, observation period, geography, and limitations. Preserve application, WAF, JVM, container, endpoint, and network evidence when suspicious deserialization behavior appears.

For related guidance from ITECS, see ITECS cybersecurity services.

Sources and update trigger

• Alibaba — Fastjson CVE-2026-16723 advisory
• NVD — CVE-2026-16723
• GitHub Advisory Database — GHSA-crf3-v9rr-v7hj

Review trigger: Recheck Alibaba, NVD, CISA KEV, and deployed dependency evidence before every remediation decision.