Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities found for fedify by fedify-dev

CVE-2026-50131 (GCVE-0-2026-50131)

Vulnerability from nvd – Published: 2026-06-10 20:27 – Updated: 2026-06-11 14:16
VLAI
Title
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-1286 - Improper Validation of Syntactic Correctness of Input
  • CWE-1389 - Incorrect Parsing of Numbers with Different Radices
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: >= 0.11.2, < 1.9.12
Affected: >= 1.10.0, < 1.10.11
Affected: >= 2.0.0, < 2.0.19
Affected: >= 2.1.0, < 2.1.15
Affected: >= 2.2.0, < 2.2.4
Create a notification for this product.
fedify-dev vocab-runtime Affected: < 2.0.19
Affected: >= 2.1.0, < 2.1.15
Affected: >= 2.2.0, < 2.2.4
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50131",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:15:27.570315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:16:17.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.11.2, \u003c 1.9.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.4"
            }
          ]
        },
        {
          "product": "vocab-runtime",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1389",
              "description": "CWE-1389: Incorrect Parsing of Numbers with Different Radices",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:27:43.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8"
        }
      ],
      "source": {
        "advisory": "GHSA-xw9q-2mv6-9fr8",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50131",
    "datePublished": "2026-06-10T20:27:43.370Z",
    "dateReserved": "2026-06-03T18:49:32.275Z",
    "dateUpdated": "2026-06-11T14:16:17.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42462 (GCVE-0-2026-42462)

Vulnerability from nvd – Published: 2026-06-10 20:22 – Updated: 2026-06-11 13:34
VLAI
Title
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
Severity
7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-347 - Improper Verification of Cryptographic Signature
  • CWE-436 - Interpretation Conflict
  • CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: >= 2.2.0, < 2.2.3
Affected: >= 2.1.0, < 2.1.14
Affected: >= 2.0.0, < 2.0.18
Affected: >= 1.10.0, < 1.10.10
Affected: < 1.9.11
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T13:31:40.827057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T13:34:03.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.10"
            },
            {
              "status": "affected",
              "version": "\u003c 1.9.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1289",
              "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:22:35.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/2.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/2.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-9rfg-v8g9-9367",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42462",
    "datePublished": "2026-06-10T20:22:35.383Z",
    "dateReserved": "2026-04-27T13:55:58.694Z",
    "dateUpdated": "2026-06-11T13:34:03.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68475 (GCVE-0-2025-68475)

Vulnerability from nvd – Published: 2025-12-22 21:31 – Updated: 2025-12-22 21:54
VLAI
Title
Fedify has ReDoS Vulnerability in HTML Parsing Regex
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: < 1.6.13
Affected: >= 1.7.0, < 1.7.14
Affected: >= 1.8.0, < 1.8.15
Affected: >= 1.9.0, < 1.9.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68475",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T21:54:29.525857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T21:54:45.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0, \u003c 1.8.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify\u0027s document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-22T21:31:20.314Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.6.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.6.13"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.7.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.7.14"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.8.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.8.15"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-rchf-xwx2-hm93",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has ReDoS Vulnerability in HTML Parsing Regex"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68475",
    "datePublished": "2025-12-22T21:31:20.314Z",
    "dateReserved": "2025-12-18T13:52:15.491Z",
    "dateUpdated": "2025-12-22T21:54:45.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-54888 (GCVE-0-2025-54888)

Vulnerability from nvd – Published: 2025-08-09 01:31 – Updated: 2026-02-04 22:13
VLAI
Title
@fedify/fedify: Improper Authentication and Incorrect Authorization
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: < 1.3.20
Affected: >= 1.4.0-dev.585, < 1.4.13
Affected: >= 1.5.0-dev.636, < 1.5.5
Affected: >= 1.6.0-dev.754, < 1.6.8
Affected: >= 1.7.0-pr.251.885, < 1.7.9
Affected: >= 1.8.0-dev.909, < 1.8.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54888",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T13:48:34.676198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T13:48:53.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T22:13:48.899Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
        }
      ],
      "source": {
        "advisory": "GHSA-6jcc-xgcr-q3h4",
        "discovery": "UNKNOWN"
      },
      "title": "@fedify/fedify: Improper Authentication and Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54888",
    "datePublished": "2025-08-09T01:31:53.319Z",
    "dateReserved": "2025-07-31T17:23:33.476Z",
    "dateUpdated": "2026-02-04T22:13:48.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50131 (GCVE-0-2026-50131)

Vulnerability from cvelistv5 – Published: 2026-06-10 20:27 – Updated: 2026-06-11 14:16
VLAI
Title
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-1286 - Improper Validation of Syntactic Correctness of Input
  • CWE-1389 - Incorrect Parsing of Numbers with Different Radices
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: >= 0.11.2, < 1.9.12
Affected: >= 1.10.0, < 1.10.11
Affected: >= 2.0.0, < 2.0.19
Affected: >= 2.1.0, < 2.1.15
Affected: >= 2.2.0, < 2.2.4
Create a notification for this product.
fedify-dev vocab-runtime Affected: < 2.0.19
Affected: >= 2.1.0, < 2.1.15
Affected: >= 2.2.0, < 2.2.4
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50131",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:15:27.570315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:16:17.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.11.2, \u003c 1.9.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.4"
            }
          ]
        },
        {
          "product": "vocab-runtime",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1286",
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1389",
              "description": "CWE-1389: Incorrect Parsing of Numbers with Different Radices",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:27:43.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8"
        }
      ],
      "source": {
        "advisory": "GHSA-xw9q-2mv6-9fr8",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50131",
    "datePublished": "2026-06-10T20:27:43.370Z",
    "dateReserved": "2026-06-03T18:49:32.275Z",
    "dateUpdated": "2026-06-11T14:16:17.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42462 (GCVE-0-2026-42462)

Vulnerability from cvelistv5 – Published: 2026-06-10 20:22 – Updated: 2026-06-11 13:34
VLAI
Title
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
Severity
7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-347 - Improper Verification of Cryptographic Signature
  • CWE-436 - Interpretation Conflict
  • CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: >= 2.2.0, < 2.2.3
Affected: >= 2.1.0, < 2.1.14
Affected: >= 2.0.0, < 2.0.18
Affected: >= 1.10.0, < 1.10.10
Affected: < 1.9.11
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T13:31:40.827057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T13:34:03.443Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0, \u003c 1.10.10"
            },
            {
              "status": "affected",
              "version": "\u003c 1.9.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1289",
              "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:22:35.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-9rfg-v8g9-9367"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/2.2.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/2.2.3"
        }
      ],
      "source": {
        "advisory": "GHSA-9rfg-v8g9-9367",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42462",
    "datePublished": "2026-06-10T20:22:35.383Z",
    "dateReserved": "2026-04-27T13:55:58.694Z",
    "dateUpdated": "2026-06-11T13:34:03.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68475 (GCVE-0-2025-68475)

Vulnerability from cvelistv5 – Published: 2025-12-22 21:31 – Updated: 2025-12-22 21:54
VLAI
Title
Fedify has ReDoS Vulnerability in HTML Parsing Regex
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: < 1.6.13
Affected: >= 1.7.0, < 1.7.14
Affected: >= 1.8.0, < 1.8.15
Affected: >= 1.9.0, < 1.9.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68475",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T21:54:29.525857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T21:54:45.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0, \u003c 1.8.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.9.0, \u003c 1.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify\u0027s document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. This issue has been patched in versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-22T21:31:20.314Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.6.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.6.13"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.7.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.7.14"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.8.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.8.15"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/releases/tag/1.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/releases/tag/1.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-rchf-xwx2-hm93",
        "discovery": "UNKNOWN"
      },
      "title": "Fedify has ReDoS Vulnerability in HTML Parsing Regex"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68475",
    "datePublished": "2025-12-22T21:31:20.314Z",
    "dateReserved": "2025-12-18T13:52:15.491Z",
    "dateUpdated": "2025-12-22T21:54:45.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-54888 (GCVE-0-2025-54888)

Vulnerability from cvelistv5 – Published: 2025-08-09 01:31 – Updated: 2026-02-04 22:13
VLAI
Title
@fedify/fedify: Improper Authentication and Incorrect Authorization
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
fedify-dev fedify Affected: < 1.3.20
Affected: >= 1.4.0-dev.585, < 1.4.13
Affected: >= 1.5.0-dev.636, < 1.5.5
Affected: >= 1.6.0-dev.754, < 1.6.8
Affected: >= 1.7.0-pr.251.885, < 1.7.9
Affected: >= 1.8.0-dev.909, < 1.8.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54888",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T13:48:34.676198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T13:48:53.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fedify",
          "vendor": "fedify-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.4.0-dev.585, \u003c 1.4.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.5.0-dev.636, \u003c 1.5.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.6.0-dev.754, \u003c 1.6.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0-pr.251.885, \u003c 1.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.8.0-dev.909, \u003c 1.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and 1.8.0-dev.909 through 1.8.4, an authentication bypass vulnerability allows any unauthenticated attacker to impersonate any ActivityPub actor by sending forged activities signed with their own keys. Activities are processed before verifying the signing key belongs to the claimed actor, enabling complete actor impersonation across all Fedify instances. This is fixed in versions 1.3.20, 1.4.13, 1.5.5, 1.6.8, 1.7.9 and 1.8.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T22:13:48.899Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4"
        },
        {
          "name": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fedify-dev/fedify/commit/14a2f8c6d2c3cbc00c3170a86ad3b7b8555c6847"
        }
      ],
      "source": {
        "advisory": "GHSA-6jcc-xgcr-q3h4",
        "discovery": "UNKNOWN"
      },
      "title": "@fedify/fedify: Improper Authentication and Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54888",
    "datePublished": "2025-08-09T01:31:53.319Z",
    "dateReserved": "2025-07-31T17:23:33.476Z",
    "dateUpdated": "2026-02-04T22:13:48.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}