Skip to content
OpenAdvisories

Vendor

fedify-dev

7 known vulnerabilities.

Products

fedify 5 hollo 2 vocab-runtime 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-62857

    Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-…

    fedify-dev fedify
  • High 8.6
    CVE-2026-50131 Public exploit

    Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the …

    fedify-dev fedify vocab-runtime @fedify/fedify npm
  • High 7.0
    CVE-2026-42462

    Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify…

    fedify-dev fedify @fedify/fedify npm
  • High 7.5
    CVE-2026-25808

    Hollo DMs get leaked and can be seen on Webfinger Browser

    Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without …

    fedify-dev hollo
  • High 7.5
    CVE-2025-68475

    Fedify has ReDoS Vulnerability in HTML Parsing Regex

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing re…

    fedify-dev fedify @fedify/fedify npm
  • High 8.7
    CVE-2025-54888

    @fedify/fedify: Improper Authentication and Incorrect Authorization

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 throug…

    fedify-dev fedify @fedify/fedify npm