{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"1.2.68","last_affected":"1.2.83"}],"component":"com.alibaba:fastjson","cve_ids":["CVE-2026-16723"],"ecosystem":"Maven","epss":0.00663,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-crf3-v9rr-v7hj","id":"tcs_01M5N8T6EMXVVQE419ZVKJDNYB","modified_at":"2026-09-10T03:51:11.563486204Z","published_at":"2026-07-23T09:32:01Z","references":["https://osv.dev/vulnerability/GHSA-crf3-v9rr-v7hj","https://nvd.nist.gov/vuln/detail/CVE-2026-16723","https://github.com/alibaba/fastjson2","https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-crf3-v9rr-v7hj","url":"https://osv.dev/vulnerability/GHSA-crf3-v9rr-v7hj"}],"summary":"fastjson has a remote code execution (RCE) vulnerability"}