Skip to content
OpenAdvisories

Package · npm

@fedify/fedify

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.6
    CVE-2026-50131 Public exploit

    Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the …

    fedify-dev fedify vocab-runtime @fedify/fedify npm
  • High 7.0
    CVE-2026-42462

    Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify…

    fedify-dev fedify @fedify/fedify npm
  • High 7.5
    CVE-2026-34148

    Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enfor…

    @fedify fedify vocab-runtime @fedify/fedify npm
  • High 7.5
    CVE-2025-68475

    Fedify has ReDoS Vulnerability in HTML Parsing Regex

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing re…

    fedify-dev fedify @fedify/fedify npm
  • High 8.7
    CVE-2025-54888

    @fedify/fedify: Improper Authentication and Incorrect Authorization

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 throug…

    fedify-dev fedify @fedify/fedify npm
  • Medium 5.4
    CVE-2025-23221

    Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanism

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the Webfinger mechanism to perform a GET request to any internal resource on any Host, Port, URL combina…

    dahlia fedify @fedify/fedify npm
  • High 7.2
    CVE-2024-39687

    Fedify vulnerable to allowing access to internal network resources

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resou…

    dahlia fedify @fedify/fedify npm