CVE-2026-16723: fastjson has a remote code execution (RCE) vulnerability

July 23, 2026 (updated August 7, 2026)

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson’s stock default configuration — no AutoType enablement required, no classpath gadget required.

References

github.com/advisories/GHSA-crf3-v9rr-v7hj
github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83
nvd.nist.gov/vuln/detail/CVE-2026-16723

Code Behaviors & Features

Detect and mitigate CVE-2026-16723 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →