Why the Fastjson2 Vulnerability Threatens Millions of Spring Boot Apps

Fastjson2 Vulnerability Overview

Many teams recently upgraded from fastjson 1.x to fastjson2 to address CVE-2026-16723, but a new remote code execution risk has emerged in fastjson2, creating a "just‑migrated‑and‑already‑compromised" situation.

The issue resides in the AutoType type‑parsing path and can be exploited under certain conditions. The problem was reported in GitHub Issue #7702, where the project maintainer confirmed the vulnerability and indicated that a fix is planned for August 2. A related pull request (#7695) was closed without being merged, and no currently released version contains the official fix.

All published versions are therefore considered vulnerable until the August 2 release. The claim that the vulnerability affects "all versions" comes from the disclosure party; the vendor has not yet published a complete impact range. The safest approach is to treat every application that depends on AutoType in fastjson2 as a high‑priority target.

Mitigation before the official fix

Teams can avoid further dependency changes by adding the JVM argument -Dfastjson2.parser.safeMode=true before the application starts, which completely disables AutoType. This setting cannot be applied via Spring’s application.yml at runtime; if business logic requires AutoType, compatibility must be verified manually.

Key takeaways

Upgrading from fastjson 1.x to 2.x only repays technical debt and does not provide a permanent security guarantee. Ensure all instances run in SafeMode, wait for the official patched version on August 2, then upgrade and revert the SafeMode flag to resume normal operation.

Relevant links: https://github.com/alibaba/fastjson2/issues/7702 and CVE‑2026‑16723.