Fast JSON parser and validator for Go. No custom structs, no code generation, no reflection - valyala/fastjson

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.

Single-tweet, standards-compliant, high-performance JSON stack - qntm/fastjson

Turning fastjson 1.2.83 into remote code execution with AutoType off and no gadget on the classpath: an SSRF inside checkAutoType, the @JSONType bypass, and a /proc/self/fd trick that carries it from ...

Hackers are actively exploiting a critical vulnerability in the FastJson open-source Java library that allows remote code execution without requiring user interaction or elevated privileges.

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Fastjson 1.x RCE vulnerability exposes systems with no patch available; users must act swiftly to mitigate risks while governance remains unclear.

Fast JSON encode/decode/validate for PHP 8.3+, backed by yyjson. Drop-in alternative to ext/json with namespaced fastjson_* functions and json_last_error-compatible error reporting. - iliaal/fastjson

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

FastJson RCE zero-day attacks expose vulnerabilities in governance of open-source software. Privacy risks can expand under current frameworks.

A critical vulnerability in FastJson, identified as CVE-2026-16723, is being exploited against organizations in the United States, putting Java applications that process untrusted JSON at immediate risk. This flaw has a CVSS severity score of 9.0 and affects FastJson versions ranging from 1.2.68 to 1.2.83, which is the final release line of FastJson 1.x.0 FastJson is an open-source Java library originally developed by Alibaba for converting Java objects to JSON and for parsing JSON data back into Java objects. The issue was disclosed on July 21, 2026, by FastJson maintainers following research conducted by FearsOff Cybersecurity. It has been confirmed in Spring Boot applications packaged as executable fat JAR files, including deployments running Spring Boot 2.x, 3.x, and 4.x on JDK versions 8, 11, 17, and 21. FastJson RCE 0-Day Vulnerability The vulnerability is particularly severe because attackers do not need valid credentials, user interaction, AutoType enabled, or any third-party deserialization gadgets in the target application’s classpath to exploit it. A vulnerable server can be attacked simply by processing malicious JSON using standard methods like JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Attackers exploit FastJson’s handling of the @type JSON field, which indicates a Java class to instantiate during deserialization. While FastJson 1.x attempts to restrict dangerous class loading by disabling AutoType by default, researchers have discovered a bypass in the library’s internal type-resolution process. In affected Spring Boot fat-JAR deployments, crafted JSON can trigger resource lookups based on an attacker-controlled class name. Threat actors can leverage nested JAR URL handling to bypass standard type restrictions and reach a code-execution path. Additionally, FastJson 1.x treats the presence of the @JSONType annotation as a trust signal, enabling malicious input to circumvent existing protections. Successful exploitation allows a remote attacker to execute arbitrary commands with the same permissions as the Java application. This can lead to the deployment of web shells or malware, data theft, credential collection, persistence creation, lateral movement within a network, or complete control over the underlying server. Exploitation attempts are being observed across various industries, including financial services, healthcare, retail, computing, and business services. Imperva reports that while most attacks have targeted U.S. organizations, smaller campaigns have also been observed in Singapore and Canada, with broader exploitation expected as public PoC details become widely available. Attackers are targeting organizations across financial, healthcare, retail, business, computing, and other sectors (source: Imperva) Many requests utilize browser-like user-agent strings to blend in with normal traffic. However, tools developed in Ruby and Go account for approximately 30% of the observed exploit traffic, indicating that automated scanning and exploitation frameworks are also in use. FastJson 2.x is not affected by CVE-2026-16723 due to its architecture, which does not perform the same resource probing on attacker-controlled type names and employs an allowlist-first approach for polymorphic deserialization. Organizations are urged to immediately enable FastJson SafeMode by using the command -DFastJson.parser.safeMode=true, or by setting ParserConfig.getGlobalInstance().setSafeMode(true). Security teams should identify both direct and transitive FastJson dependencies, search logs for suspicious @type, jar:http, and jar:file values, and investigate any unexpected commands, outbound connections, unauthorized file modifications, and web shells. Since FastJson 1.x is no longer actively maintained and no patch is available for this issue, affected organizations should prioritize migrating to FastJson 2.x after conducting compatibility testing.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post Hackers Exploiting FastJson RCE 0-Day in the Wild to Attack US-based Organizations appeared first on Cyber Security News .

Added fastjson_last_error_pos() and fastjson_last_error_info(): surface the byte offset and 1-based line/column of the most recent parse error (yyjson computed it, fastjson previously discarded it...

Added fastjson_pointer_get(string $json, string $pointer, ?bool $associative = null, int $depth = 512, int $flags = 0): mixed: read a single value from a JSON document by RFC 6901 JSON Pointer (/...

Fastjson 1.x flaw CVE-2026-16723 can trigger unauthenticated RCE in Spring Boot fat-JAR apps, with attacks reported and no patched 1.x fix available.

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges.

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

Build Added config.w32 so the php-windows-builder action can build Windows DLLs. 0.2.0 shipped without one and the release-windows.yml workflow couldn't compile the extension. No source changes; i...

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

TL;DR Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through 1.2.83 under stock default settings. Full technical details are public, and third parties have since released working proof-of-concept code. Why it matters This flaw needs no classpath gadget. That breaks the usual defense playbook. Removing risky dependencies or extending blocklists will not help here.