Skip to content
OpenAdvisories

Package · npm

@fedify/vocab-runtime

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.6
    CVE-2026-50131 Public exploit

    Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the …

    fedify-dev fedify vocab-runtime @fedify/fedify npm
  • High 7.5
    CVE-2026-34148

    Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enfor…

    @fedify fedify vocab-runtime @fedify/fedify npm