Do Son 
Image: @ckcsec
TL;DR
Researcher Kirill Firsov disclosed a fastjson RCE on July 19, 2026. It affects fastjson 1.2.68 through 1.2.83 under stock default settings. Full technical details are public, and third parties have since released working proof-of-concept code.
Why it matters
This flaw needs no classpath gadget. That breaks the usual defense playbook. Removing risky dependencies or extending blocklists will not help here. Turning AutoType off does not help either.
Naming a target class offers no protection. Attackers can nest payloads inside Object or Map fields of that class. Chinese security vendor Qi’anxin, which tracks the bug as QVD-2026-43021, estimates millions of exposed instances. Any endpoint parsing untrusted JSON becomes a possible entry point.
How the attack works
The root cause sits in fastjson’s type-resolution logic. That path probes for class metadata using a user-supplied class name. Meanwhile, the @JSONType annotation acts as a trust signal, so a supplied class returns early. It therefore skips the dangerous-base-class checks.
Spring Boot’s fat-jar classloader completes the chain. It can resolve remote class resources over HTTP. So the server fetches and loads attacker-controlled code. Firsov’s FearsOff research write-up covers the full chain. This report shares no exploit code.
Conditions matter
Independent analyses stress that outcomes vary. On JDK 8, full code execution is most likely. On newer JDKs, the result often degrades to server-side request forgery. The target also needs outbound HTTP access to reach the attacker’s host.
Affected versions
Versions 1.2.68 through 1.2.83 are affected, with SafeMode off. All fastjson2 releases are safe by design. Builds at 1.2.60 or older lack the vulnerable path. Non-fat-jar deployments, such as WAR files, do not meet the trigger condition.
Mitigation steps
First, set SafeMode to true right away. Alternatively, switch to a noneautotype build. Next, plan a migration to fastjson2, since 1.x has reached its final release. Blocking outbound HTTP from application servers also cuts the chain. The official security advisory lists every step. No confirmed in-the-wild exploitation has been reported yet. With a public PoC circulating, though, this fastjson RCE needs urgent attention.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
