# Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated Remote Code Execution (Fastjson2 <= 2.0.62)

> Fastjson2 versions <= 2.0.62 process the JSON @type field against a built-in AutoType whitelist even when SupportAutoType is not explicitly enabled, and that whitelist is verified only via FNV-1a hash comparison rather than actual class-name string validation. An unauthenticated attacker can craft a malicious JSON payload that satisfies the hash check while resolving an unintended class, achieving remote code execution without any third-party gadget chain. Fastjson2 releases above 2.0.62 are reported unaffected; no CVE has been assigned and no merged upstream patch exists as of 2026-07-29.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1752
- **ID:** TL-2026-1752
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-29, NSFOCUS CERT published a critical (CVSS 9.8) vulnerability notice for Fastjson2, Alibaba's high-performance Java JSON library (com.alibaba:fastjson2), affecting all 2.x releases up to and including 2.0.62. Fastjson2 was designed to be secure-by-default relative to the legacy Fastjson 1.x branch: AutoType (automatic polymorphic deserialization triggered by an @type field) is disabled unless explicitly enabled by the application. This notice shows that design assumption does not fully hold — Fastjson2 still carries an internal AutoType whitelist that the deserializer consults even when SupportAutoType has not been turned on, and specific attacker-supplied @type values can pass that check.

The root cause, corroborated by the alibaba/fastjson2 hardening pull request #7695 (opened to address the issue and closed 2026-07-25 without being merged to main), is that the whitelist implementation (centered on ObjectReaderProvider.java, ContextAutoTypeBeforeHandler.java, and TypeUtils.java) accepted class names by comparing only a precomputed FNV-1a hash (acceptHashCodes) against the incoming type name's hash, without a secondary string-equality check against the actual registered class name (acceptNameSet). Because hash comparison alone cannot guarantee the input string is the exact intended class name, an attacker can supply a crafted @type value that satisfies the hash check for a whitelisted entry while the loader still resolves an unintended, attacker-influenced class reference. Unlike the classic Fastjson 1.x deserialization gadget chains (e.g. com.sun.rowset.JdbcRowSetImpl or TemplatesImpl chains, which require specific third-party classes on the target's classpath), this Fastjson2 issue requires no external gadget class — the built-in whitelist itself is the exploitation surface. PR #7695 additionally hardened against URL-special-character (':' and '!') smuggling in type names and applied ClassLoader/DataSource/RowSet blacklist checks consistently across both AutoType code paths, indicating the maintainers found more than one bypass primitive in the same subsystem.

The disclosure lands during a period of heightened scrutiny of the broader Fastjson ecosystem: on 2026-07-21, Alibaba published a separate advisory for CVE-2026-16723, a distinct, critical (CVSS 9.0) unauthenticated RCE in the legacy Fastjson 1.x branch (1.2.68-1.2.83), discovered by FearsOff Cybersecurity, which by 2026-07-25 was under confirmed active exploitation against Spring Boot fat-JAR deployments across financial services, healthcare, computing, and retail organizations in the US, Singapore, and Canada. CVE-2026-16723 and the Fastjson2 <= 2.0.62 whitelist bypass documented here are architecturally distinct (different branch, different bypass primitive, different code paths) and must not be conflated, but both share the same @type-driven trigger surface and the same primary mitigation (SafeMode), and their concurrent disclosure materially raises the likelihood that the Fastjson2 issue receives rapid weaponization attention once technical detail circulates further. A technical write-up on the Fastjson2 whitelist bypass by Chinese security firm 长亭 (Chuangyu/Longting), published via WeChat, is referenced in alibaba/fastjson2 GitHub issue #7702 (opened 2026-07-27), and third-party reproduction (gm7.org, 2026-07) reports the issue as reproduced with a working PoC/EXP, additionally identifying the unmerged hardening patch's commit hash as 6fc6f9502b68f7cb6057067217ea057d6a58b083. GitHub's own release tagging for fastjson2 shows the last vulnerable tagged release as 2.0.61, while the Maven Central artifact 2.0.62 (published 2026-05-05) is also confirmed vulnerable — a minor discrepancy between GitHub release tags and Maven publish versioning that defenders should account for when inventorying exposure.

Underscoring how closely watched the concurrent sibling disclosure became: ThreatBook, a threat-intelligence platform, added detection support for CVE-2026-16723 and captured in-the-wild exploitation traffic against it by 2026-07-22, one day after Alibaba's advisory; by contrast, CISA's public exploitation-status assessment for that same sibling CVE was still marked "none" as of 2026-07-23, an unexplained discrepancy between vendor telemetry and the federal tracker that illustrates the lag defenders should expect between vendor-observed exploitation and authoritative catalog updates — a dynamic directly relevant to monitoring this still-unassigned Fastjson2 issue for its own future KEV listing.

As of the NSFOCUS notice, no CVE identifier has been assigned to this Fastjson2 issue, it is absent from the CISA Known Exploited Vulnerabilities catalog, and no finalized upstream patched release has shipped (PR #7695 was closed unmerged). The only available mitigation is SafeMode, which fully disables AutoType and is configurable via code (ParserConfig.getGlobalInstance().setSafeMode(true)), a JVM flag (-Dfastjson.parser.safeMode=true), or a classpath properties file (fastjson.parser.safeMode=true). NSFOCUS additionally recommends WAF rules that inspect inbound JSON bodies for an @type field, including encoded/obfuscated variants, as an interim compensating control.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1505 Server Software Component
- T1071 Application Layer Protocol
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1489 Service Stop

## Sources

- [Fastjson 2.x Remote Code Execution Vulnerability Notice](https://nsfocusglobal.com/fastjson-2-x-remote-code-execution-vulnerability-notice/)
- [alibaba/fastjson2 issue #7702 — patched release timeline / AutoType whitelist bypass discussion](https://github.com/alibaba/fastjson2/issues/7702)
- [alibaba/fastjson2 pull request #7695 — AutoType validation and whitelist hardening (closed unmerged)](https://github.com/alibaba/fastjson2/pull/7695)
- [【已复现】Fastjson2 远程代码执行漏洞 (Fastjson2 RCE reproduction analysis)](https://www.gm7.org/archives/134195)
- [How the Fastjson RCE Vulnerability Actually Works, and How to Check You're Exposed](https://latesthackingnews.com/2026/07/26/fastjson-rce-vulnerability-how-to-check/)
- [Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patch Available](https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html)
- [Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/)
- [CVE-2026-16723](https://www.tenable.com/cve/CVE-2026-16723)
- [alibaba/fastjson2 — upstream repository](https://github.com/alibaba/fastjson2)
- [长亭 (Chuangyu/Longting) WeChat technical write-up on the Fastjson2 AutoType whitelist bypass (cited in GitHub issue #7702)](https://mp.weixin.qq.com/s/LJaul1jNjK9pXRAkoUiMEA)
- [Fastjson 1.2.x Remote Code Execution Without Gadget Vulnerability Notice](https://nsfocusglobal.com/fastjson-1-2-x-remote-code-execution-without-gadget-vulnerability-notice/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1752