Skip to content
Sign in
9.0 Critical

CVE-2026-16723 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83

Description

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Affected products and versions

Product Affected versions Fixed in
Fastjson 1.2 1.2.68 → 1.2.83 No fix stated

Other CVEs of Fastjson

The 2 CVEs of Fastjson →
CVE-2025-70974 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key… 10.0 Critical
Track this CVE