Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation

A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a vulnerable server by sending it specially crafted JSON — no user privileges, no victim interaction, and no third-party libraries required. ThreatBook TDP® (Threat Detection Platform) has already captured this vulnerability being exploited in the wild, so if you run an affected version without SafeMode enabled, treat remediation as urgent.

TL;DR/Key Takeaways

• Severity: High risk (overall remediation priority).
• Vulnerability type: RCE (remote code execution). ThreatBook ID XVE-2026-39684. No CVE ID assigned.
• Affected versions: Fastjson version ≤ 1.2.83.
• Exploit conditions: Network-reachable target, no user privileges, no victim interaction, no security-mechanism bypass required — exploitable whenever Fastjson SafeMode is not enabled.
• In the wild: Public proof of concept exists, and ThreatBook TDP has captured active exploitation.
• Already detected: ThreatBook TDP added detection support on July 20, 2026 (detection ID S3100181015). Enable SafeMode and block the payload signatures below now.

Vulnerability Overview

Fastjson is an open-source, Java-based, high-performance JSON parser and generator, originally developed by Alibaba and widely used for JSON serialization and deserialization across Java applications.

ThreatBook's intelligence team observed the public disclosure of a Fastjson remote code execution vulnerability. Analysis confirms that Fastjson versions ≤ 1.2.83 contain a remote code execution vulnerability: a remote attacker can execute arbitrary code on the target server by sending specially crafted malicious JSON to an application running an affected version — without relying on any third-party libraries.

Exploitation requires no user privileges. An attacker who successfully exploits it can execute arbitrary code on a target server that has not enabled SafeMode, directly threatening the confidentiality, integrity, and availability of the system and potentially leading to full compromise of the server. Affected users are advised to remediate as soon as possible.

Remediation Priority — Vulnerability Prioritization Technology (VPT)

Overall remediation priority: High risk.

Affected Scope

Verified Reproduction Scenarios

ThreatBook validated the following scenarios to date:

1. Spring Boot embedded Tomcat (default web request entry point): full RCE was not reproduced, but a remote JAR fetch / SSRF is triggered.
2. Spring Boot FatJar on JDK 8: jar:http can be fully reproduced.
3. jar:file method: not affected by the environments described above.

Figure 1 — Reproduction of the Fastjson remote code execution vulnerability.

Mitigation and Remediation

Temporary mitigation

No official patch or fixed version has been released for this vulnerability. Because the Fastjson 1.x series is no longer maintained, the recommended path is to migrate to Fastjson 2.x.

Until you can migrate, enable Fastjson SafeMode using any one of the following methods:

• In code: ParserConfig.getGlobalInstance().setSafeMode(true)
• Via JVM startup parameter: -Dfastjson.parser.safeMode=true
• Via configuration file: fastjson.parser.safeMode=true

Perimeter blocking (WAF / IPS)

Use protective or perimeter devices to block POST and JSON requests containing either of the following exact match strings:

• @type":"jar:file:.
• @type":"jar:http:..

Migration guidance

The durable fix is migration to Fastjson 2.x. SafeMode and perimeter blocking reduce exposure but do not replace an upgrade off an unmaintained release line.

How ThreatBook Protects You

ThreatBook's vulnerability intelligence cataloged this vulnerability on July 20, 2026.

ThreatBook TDP added detection support on July 20, 2026. Detection ID: S3100181015. Detection is available with a model/rule version above 20260720000000. TDP has already captured this vulnerability being exploited in the wild — so environments running TDP at or above that rule version are covered against the observed exploitation activity.

Figure 2 — ThreatBook TDP detection for the Fastjson remote code execution vulnerability.

What to Do Now

If you run Fastjson ≤ 1.2.83, enable SafeMode, block the payload signatures at your perimeter, and plan your migration to Fastjson 2.x. To see how ThreatBook TDP detects exploitation like this across your network, visit threatbook.io.